Log in Start free

Vulnerability · Published Oct 6, 2022 · Assigned by GitHub_M

CVE-2022-39269Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip

Critical 9.1

In plain English

A critical-severity security flaw in pjproject from pjsip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.7%top 45.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP. The patch is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20pjproject2.13-r0ALPINE-CVE-2022-39269
Alpine:v3.21pjproject2.13-r0ALPINE-CVE-2022-39269
Alpine:v3.22pjproject2.13-r0ALPINE-CVE-2022-39269
Alpine:v3.23pjproject2.13-r0ALPINE-CVE-2022-39269
Alpine:v3.24pjproject2.13-r0ALPINE-CVE-2022-39269
Debian:14asterisk1:20.3.0~dfsg+~cs6.13.40431413-1DEBIAN-CVE-2022-39269
Debian:12ring20230206.0~ds1-1DEBIAN-CVE-2022-39269
Ubuntu:22.04:LTSasteriskno fix listedUBUNTU-CVE-2022-39269
Ubuntu:24.04:LTSasteriskno fix listedUBUNTU-CVE-2022-39269
Ubuntu:25.10asteriskno fix listedUBUNTU-CVE-2022-39269
Ubuntu:26.04:LTSasteriskno fix listedUBUNTU-CVE-2022-39269
Ubuntu:26.10asteriskno fix listedUBUNTU-CVE-2022-39269

Affected products (as reported)

VendorProductVersions
pjsip pjproject >= 2.11, < 2.13

Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References