CVE-2022-24763

Published on: Not Yet Published

Last Modified on: 01/27/2023 07:51:00 PM UTC

CVE-2022-24763 - advisory for GHSA-5x45-qp78-g4p4

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Certain versions of Debian Linux from Debian contain the following vulnerability:

PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds.

CVE-2022-24763 has been assigned by [email protected] to track the vulnerability - currently rated as HIGH severity.
Affected Vendor/Software: pjsip - pjproject version <= 2.12

CVSS3 Score: 7.5 - HIGH

Attack Vector ^ⓘ	Attack Complexity	Privileges Required	User Interaction
NETWORK	LOW	NONE	NONE
Scope	Confidentiality Impact	Integrity Impact	Availability Impact
UNCHANGED	NONE	NONE	HIGH

CVSS2 Score: 5 - MEDIUM

Access Vector^ⓘ	Access Complexity	Authentication
NETWORK	LOW	NONE
Confidentiality Impact	Integrity Impact	Availability Impact
NONE	NONE	PARTIAL

CVE References

Description	Tags ^ⓘ	Link
Denial-of-service in XML parsing due to an infinite loop · Advisory · pjsip/pjproject · GitHub	github.com text/html	CONFIRM github.com/pjsip/pjproject/security/advisories/GHSA-5x45-qp78-g4p4
PJSIP: Multiple Vulnerabilities (GLSA 202210-37) — Gentoo security	security.gentoo.org text/html	GENTOO GLSA-202210-37
[SECURITY] [DLA 3036-1] pjproject security update	lists.debian.org text/html	MLIST [debian-lts-announce] 20220531 [SECURITY] [DLA 3036-1] pjproject security update
Debian -- Security Information -- DSA-5285-1 asterisk	www.debian.org Depreciated Link text/html	DEBIAN DSA-5285
[SECURITY] [DLA 3194-1] asterisk security update	lists.debian.org text/html	MLIST [debian-lts-announce] 20221117 [SECURITY] [DLA 3194-1] asterisk security update
Merge pull request from GHSA-5x45-qp78-g4p4 · pjsip/[email protected] · GitHub	github.com text/html	MISC github.com/pjsip/pjproject/commit/856f87c2e97a27b256482dbe0d748b1194355a21

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

Related QID Numbers

179340 Debian Security Update for pjproject (DLA 3036-1)
181225 Debian Security Update for asterisk (DLA 3194-1)
181237 Debian Security Update for asterisk (DSA 5285-1)
502232 Alpine Linux Security Update for pjproject
710674 Gentoo Linux PJSIP Multiple Vulnerabilities (GLSA 202210-37)

Exploit/POC from Github

This repository contains a collection of data files on known Common Vulnerabilities and Exposures (CVEs). Each file i…

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	10.0	All	All	All
Operating System	Debian	Debian Linux	11.0	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Application	Pjsip	Pjsip	All	All	All	All

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*:
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*:
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*:
cpe:2.3:a:pjsip:pjsip:*:*:*:*:*:*:*:*:

No vendor comments have been submitted for this CVE

Social Mentions

Source	Title	Posted (UTC)
@CVEreport	CVE-2022-24763 : PJSIP is a free and open source multimedia communication library written in the C language. Versio… twitter.com/i/web/status/1…	2022-03-30 21:09:24
/r/netcve	CVE-2022-24763	2022-03-30 22:39:08