CVE-2022-24764: Stack buffer overflow in pjproject
PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API pjmediasdpprint(), pjmediasdpmediaprint(). Applications that do not use PJSUA2 and do not directly call pjmediasdpprint() or pjmediasdpmediaprint() should not be affected. A patch is available on the master branch of the pjsip/pjproject GitHub repository. There are currently no known workarounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ringto a version that resolves this vulnerability.Fixed in 20180228.1.503 - Upgrade
Upgrade
ubuntu/ringto a version that resolves this vulnerability.Fixed in 20190215.1. - Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1 - Upgrade
Upgrade
debian/ringto a version that resolves this vulnerability.Fixed in 20230206.0~ds2-1.1+deb12u1 - Upgrade
Upgrade
alpine/pjprojectto a version that resolves this vulnerability.Fixed in 2.12.1-r0 - Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1 - Upgrade
Upgrade
debian/ringto a version that resolves this vulnerability.Fixed in 20230206.0~ds1-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-24764?
CVE-2022-24764 is a stack buffer overflow vulnerability in PJSIP versions 2.12 and prior.
Who is affected by CVE-2022-24764?
Users of PJSUA2 library or users calling the API pjmedia_sdp_print(), pjmedia_sdp_media_print() are affected by CVE-2022-24764.
What is the severity of CVE-2022-24764?
The severity of CVE-2022-24764 is high, with a severity value of 7.5.
How can I fix CVE-2022-24764?
To fix CVE-2022-24764, it is recommended to update to a version of PJSIP that is later than 2.12.
What are the references for CVE-2022-24764?
The references for CVE-2022-24764 include: [1] https://security-tracker.debian.org/tracker/CVE-2022-24764, [2] https://github.com/pjsip/pjproject/security/advisories/GHSA-f5qg-pqcg-765m, [3] https://github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b00