CVE-2023-38703

2023-10-0614:15:12

CWE-416

[email protected]

web.nvd.nist.gov

cve-2023-38703

pjsip

srtp

multimedia communication

vulnerability

use-after-free

udp

ice

patch available

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.9%

JSON

PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (PJMEDIA_HAS_SRTP is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch.

Affected configurations

Vulners

NVD

Node

pjsippjsipRange≤2.13.1

VendorProductVersionCPE
pjsippjsip*cpe:2.3:a:pjsip:pjsip:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pjsip	pjsip	*	cpe:2.3:a:pjsip:pjsip::::::::

CNA Affected

[
  {
    "vendor": "pjsip",
    "product": "pjproject",
    "versions": [
      {
        "version": "<= 2.13.1",
        "status": "affected"
      }
    ]
  }
]