Vulnerability · Published Dec 23, 2022 · Assigned by GitHub_M
CVE-2022-23547Heap buffer overflow in pjproject when decoding STUN message
Medium 6.5
In plain English
A medium-severity heap buffer overflow in pjproject from pjsip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a certain STUN message. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as commit in the master branch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | asterisk | 1:20.4.0~dfsg+~cs6.13.40431414-1 | DEBIAN-CVE-2022-23547 |
| Debian:12 | ring | 20230206.0~ds1-1 | DEBIAN-CVE-2022-23547 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
References
- https://github.com/pjsip/pjproject/security/advisories/GHSA-cxwq-5g9x-x7fr x_refsource_CONFIRM
- https://github.com/pjsip/pjproject/security/advisories/GHSA-9pfh-r8x4-w26w x_refsource_MISC
- https://github.com/pjsip/pjproject/commit/bc4812d31a67d5e2f973fbfaf950d6118226cf36 x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html