CVE-2022-24786: Potential out-of-bound read/write in PJSIP
First published: Wed Apr 06 2022(Updated: )
PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Pjsip Pjsip | <=2.12 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| debian/asterisk | <=1:16.2.1~dfsg-1+deb10u2 | 1:16.28.0~dfsg-0+deb10u4 1:16.28.0~dfsg-0+deb11u3 1:20.5.2~dfsg+~cs6.13.40431414-1 |
| debian/ring | <=20190215.1.f152c98~ds1-1+deb10u1<=20190215.1.f152c98~ds1-1+deb10u2<=20210112.2.b757bac~ds1-1 | 20230206.0~ds2-1.1 20230922.0~ds2-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/pjsip/pjproject/commit/11559e49e65bdf00922ad5ae28913ec6a198d508
- https://github.com/pjsip/pjproject/security/advisories/GHSA-vhxv-phmx-g52q
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://security.gentoo.org/glsa/202210-37
- https://www.debian.org/security/2022/dsa-5285
- https://security-tracker.debian.org/tracker/CVE-2022-24786
Frequently Asked Questions
What is CVE-2022-24786?
CVE-2022-24786 is a vulnerability in the PJSIP multimedia communication library that affects versions 2.12 and prior.
How severe is CVE-2022-24786?
CVE-2022-24786 has a severity rating of 9.8, which is considered critical.
Which software versions are affected by CVE-2022-24786?
The affected software versions include PJSIP 2.12 and Debian Linux versions 9.0 and 10.0.
How can I fix CVE-2022-24786?
To fix CVE-2022-24786, it is recommended to apply the available patch provided by PJSIP.
Where can I find more information about CVE-2022-24786?
You can find more information about CVE-2022-24786 on the official PJSIP GitHub security advisories page and the Debian security tracker.
- collector/nvd-index
- collector/security-tracker-debian
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/title
- agent/references
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/pjsip
- canonical/pjsip pjsip
- version/pjsip pjsip/2.12
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- package-manager/debian