CVE-2023-27585
Summary
| CVE | CVE-2023-27585 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-03-14 17:15:00 UTC |
| Updated | 2023-08-30 01:15:00 UTC |
| Description | PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation instead. |
Risk And Classification
Problem Types: CWE-120 | CWE-122
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| DNS Asynchronous/Caching Resolution Engine (2.10) | MISC | www.pjsip.org | |
| Heap buffer overflow when parsing DNS packet (2) · Advisory · pjsip/pjproject · GitHub | MISC | github.com | |
| Debian -- Security Information -- DSA-5438-1 asterisk | DEBIAN | www.debian.org | |
| [SECURITY] [DLA 3394-1] asterisk security update | MLIST | lists.debian.org | |
| [SECURITY] [DLA 3549-1] ring security update | MLIST | lists.debian.org | |
| Merge pull request from GHSA-q9cp-8wcq-7pfr · pjsip/pjproject@d1c5e4d · GitHub | MISC | github.com | |
| Potential heap buffer overflow when parsing DNS packets · Advisory · pjsip/pjproject · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 181742 Debian Security Update for asterisk (DLA 3394-1)
- 199817 Ubuntu Security Notification for Ring Vulnerabilities (USN-6422-1)
- 199901 Ubuntu Security Notification for Ring Vulnerabilities (USN-6422-2)
- 503543 Alpine Linux Security Update for pjproject
- 505918 Alpine Linux Security Update for pjproject
- 6000045 Debian Security Update for ring (DLA 3549-1)
- 6000231 Debian Security Update for asterisk (DSA 5438-1)