CVE-2022-21722: Potential out-of-bound read during RTP/RTCP parsing in PJSIP
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the master branch. There are no known workarounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ringto a version that resolves this vulnerability.Fixed in 20190215.1. - Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1 - Upgrade
Upgrade
debian/ringto a version that resolves this vulnerability.Fixed in 20230206.0~ds2-1.1+deb12u1 - Upgrade
Upgrade
alpine/pjprojectto a version that resolves this vulnerability.Fixed in 2.12-r0 - Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:18.12.0~dfsg+~cs6.12.40431413-1 - Upgrade
Upgrade
debian/ringto a version that resolves this vulnerability.Fixed in 20230206.0~ds1-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-21722?
CVE-2022-21722 is a vulnerability in the PJSIP multimedia communication library that can allow certain incoming RTP/RTCP packets to cause issues.
What software versions are affected by CVE-2022-21722?
Versions up to and including 2.11.1 of Teluu Pjsip, Debian Linux 9.0 and 10.0, and certain versions of Ubuntu Ring and Debian Asterisk and Ring are affected.
How severe is CVE-2022-21722?
CVE-2022-21722 has a severity score of 9.1 (critical).
What is the fix for CVE-2022-21722?
To fix CVE-2022-21722, you should update to a patched version of the PJSIP library or apply the necessary security patches provided by your software vendor.
Where can I find more information about CVE-2022-21722?
You can find more information about CVE-2022-21722 on the following references: [link1], [link2], [link3].