CVE-2022-24786: Potential out-of-bound read/write in PJSIP
PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmediartcpfbparserpsi() will be affected. A patch is available in the master branch of the pjsip/pjproject GitHub repository. There are currently no known workarounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1 - Upgrade
Upgrade
debian/ringto a version that resolves this vulnerability.Fixed in 20230206.0~ds2-1.1+deb12u1 - Upgrade
Upgrade
alpine/pjprojectto a version that resolves this vulnerability.Fixed in 2.12.1-r0 - Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1 - Upgrade
Upgrade
debian/ringto a version that resolves this vulnerability.Fixed in 20230206.0~ds1-1
Event History
Frequently Asked Questions
What is CVE-2022-24786?
CVE-2022-24786 is a vulnerability in the PJSIP multimedia communication library that affects versions 2.12 and prior.
How severe is CVE-2022-24786?
CVE-2022-24786 has a severity rating of 9.8, which is considered critical.
Which software versions are affected by CVE-2022-24786?
The affected software versions include PJSIP 2.12 and Debian Linux versions 9.0 and 10.0.
How can I fix CVE-2022-24786?
To fix CVE-2022-24786, it is recommended to apply the available patch provided by PJSIP.
Where can I find more information about CVE-2022-24786?
You can find more information about CVE-2022-24786 on the official PJSIP GitHub security advisories page and the Debian security tracker.