CVE-2022-23537

2022-12-2000:00:00

ubuntu.com

pjsip

multimedia communication

buffer overread

stun

sip

sdp

rtp

pjnath

pjsua-lib

vulnerability

patch

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

57.2%

JSON

PJSIP is a free and open source multimedia communication library written in
C language implementing standard based protocols such as SIP, SDP, RTP,
STUN, TURN, and ICE. Buffer overread is possible when parsing a specially
crafted STUN message with unknown attribute. The vulnerability affects
applications that uses STUN including PJNATH and PJSUA-LIB. The patch is
available as a commit in the master branch (2.13.1).

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchasterisk< anyUNKNOWN
ubuntu24.04noarchasterisk< anyUNKNOWN
ubuntu16.04noarchasterisk< anyUNKNOWN
ubuntu18.04noarchpjproject< anyUNKNOWN
ubuntu16.04noarchpjproject< anyUNKNOWN
ubuntu18.04noarchring< 20180228.1.503da2b~ds1-1ubuntu0.1~esm1UNKNOWN
ubuntu20.04noarchring< 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	22.04	noarch	asterisk	< any	UNKNOWN
ubuntu	24.04	noarch	asterisk	< any	UNKNOWN
ubuntu	16.04	noarch	asterisk	< any	UNKNOWN
ubuntu	18.04	noarch	pjproject	< any	UNKNOWN
ubuntu	16.04	noarch	pjproject	< any	UNKNOWN
ubuntu	18.04	noarch	ring	< 20180228.1.503da2b~ds1-1ubuntu0.1~esm1	UNKNOWN
ubuntu	20.04	noarch	ring	< 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1	UNKNOWN