CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
57.9%
PJSIP is a free and open source multimedia communication library written in
C language implementing standard based protocols such as SIP, SDP, RTP,
STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible
buffer overread when parsing a certain STUN message. The vulnerability
affects applications that uses STUN including PJNATH and PJSUA-LIB. The
patch is available as commit in the master branch.
github.com/pjsip/pjproject/commit/bc4812d31a67d5e2f973fbfaf950d6118226cf36
github.com/pjsip/pjproject/security/advisories/GHSA-9pfh-r8x4-w26w
github.com/pjsip/pjproject/security/advisories/GHSA-cxwq-5g9x-x7fr
launchpad.net/bugs/cve/CVE-2022-23547
nvd.nist.gov/vuln/detail/CVE-2022-23547
security-tracker.debian.org/tracker/CVE-2022-23547
ubuntu.com/security/notices/USN-6422-1
www.cve.org/CVERecord?id=CVE-2022-23547