Lucene search

GitHub_MCVE-2022-23537

HistoryDec 20, 2022 - 7:15 p.m.

CVE-2022-23537

2022-12-2019:15:24

CWE-122

CWE-125

GitHub_M

web.nvd.nist.gov

pjsip

multimedia communication

sip

sdp

rtp

stun

turn

ice

buffer overread

vulnerability

patch

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

57.2%

JSON

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch (2.13.1).

Affected configurations

Nvd

Vulners

Node

teluupjsipRange<2.13.1

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
teluupjsip*cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
teluu	pjsip	*	cpe:2.3:a:teluu:pjsip::::::::
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*

CNA Affected

[
  {
    "vendor": "pjsip",
    "product": "pjproject",
    "versions": [
      {
        "version": "<= 2.13",
        "status": "affected"
      }
    ]
  }
]