CVE-2023-38703: PJSIP has use-after-free vulnerability in SRTP media transport
PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (PJMEDIAHASSRTP is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-38703?
CVE-2023-38703 is a vulnerability in the PJSIP multimedia communication library that allows for unauthorized access and potential remote code execution.
What is PJSIP?
PJSIP is a free and open source multimedia communication library written in C with high-level APIs in C, C++, Java, C#, and Python.
What is the severity of CVE-2023-38703?
CVE-2023-38703 has a severity of critical with a CVSS score of 9.8.
What is SRTP?
SRTP is a higher-level media transport used in PJSIP, which is stacked upon a lower-level transport such as UDP and ICE.
How can I fix CVE-2023-38703?
To fix CVE-2023-38703, you should update the affected software to version 2.13.2 or later.