CVE-2022-24786
Summary
| CVE | CVE-2022-24786 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-04-06 14:15:00 UTC |
| Updated | 2023-02-02 18:30:00 UTC |
| Description | PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds. |
Risk And Classification
Problem Types: CWE-125 | CWE-787
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Application | Pjsip | Pjsip | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Potential out-of-bound read/write when parsing RTCP FB RPSI · Advisory · pjsip/pjproject · GitHub | CONFIRM | github.com | |
| PJSIP: Multiple Vulnerabilities (GLSA 202210-37) — Gentoo security | GENTOO | security.gentoo.org | |
| Debian -- Security Information -- DSA-5285-1 asterisk | DEBIAN | www.debian.org | |
| Merge pull request from GHSA-vhxv-phmx-g52q · pjsip/pjproject@11559e4 · GitHub | MISC | github.com | |
| [SECURITY] [DLA 3194-1] asterisk security update | MLIST | lists.debian.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 181225 Debian Security Update for asterisk (DLA 3194-1)
- 181237 Debian Security Update for asterisk (DSA 5285-1)
- 184895 Debian Security Update for ring (CVE-2022-24786)
- 502232 Alpine Linux Security Update for pjproject
- 504293 Alpine Linux Security Update for pjproject
- 710674 Gentoo Linux PJSIP Multiple Vulnerabilities (GLSA 202210-37)