CVE-2022-24793: Potential heap buffer overflow when parsing DNS packets in PJSIP
PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.12 and prior affects applications that use PJSIP DNS resolution. It doesn't affect PJSIP users who utilize an external resolver. This vulnerability is related to CVE-2023-27585. The difference is that this issue is in parsing the query record parserr(), while the issue in CVE-2023-27585 is in parsequery(). A patch is available in the master branch of the pjsip/pjproject GitHub repository. A workaround is to disable DNS resolution in PJSIP config (by setting nameservercount to zero) or use an external resolver instead.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ringto a version that resolves this vulnerability.Fixed in 20180228.1.503 - Upgrade
Upgrade
ubuntu/ringto a version that resolves this vulnerability.Fixed in 20190215.1. - Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1 - Upgrade
Upgrade
debian/ringto a version that resolves this vulnerability.Fixed in 20230206.0~ds2-1.1+deb12u1 - Upgrade
Upgrade
alpine/pjprojectto a version that resolves this vulnerability.Fixed in 2.12.1-r0 - Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1 - Upgrade
Upgrade
debian/ringto a version that resolves this vulnerability.Fixed in 20230206.0~ds1-1 - Configuration
Disable DNS resolution in the PJSIP configuration by setting nameserver_count to zero.
PJSIP nameserver_count = 0 - Compensating control
Configure applications using PJSIP to use an external DNS resolver instead of PJSIP DNS resolution.
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-24793?
CVE-2022-24793 is a buffer overflow vulnerability in PJSIP DNS resolution that affects versions 2.12 and prior.
Which applications are affected by CVE-2022-24793?
Applications that use PJSIP DNS resolution are affected by CVE-2022-24793.
Does CVE-2022-24793 affect PJSIP users who utilize an external resolver?
No, PJSIP users who utilize an external resolver are not affected by CVE-2022-24793.
What is the severity of CVE-2022-24793?
CVE-2022-24793 has a severity rating of high (7.5).
How can I fix CVE-2022-24793?
To fix CVE-2022-24793, update to a version of PJSIP that is after 2.12.