CVE-2022-21722

NameCVE-2022-21722
DescriptionPJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2962-1, DLA-3194-1, DLA-3549-1, DLA-3887-1, DSA-5285-1
Debian Bugs1014998

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
asterisk (PTS)jessie, jessie (lts)1:11.13.1~dfsg-2+deb8u8vulnerable
stretch (security)1:13.14.1~dfsg-2+deb9u6fixed
stretch (lts), stretch1:13.14.1~dfsg-2+deb9u10fixed
buster, buster (lts)1:16.28.0~dfsg-0+deb10u5fixed
buster (security)1:16.28.0~dfsg-0+deb10u4fixed
bullseye1:16.28.0~dfsg-0+deb11u4fixed
bullseye (security)1:16.28.0~dfsg-0+deb11u5fixed
sid1:22.1.0~dfsg+~cs6.14.60671435-1fixed
pjproject (PTS)jessie, jessie (lts)2.1.0.0.ast20130823-1+deb8u1vulnerable
stretch (security)2.5.5~dfsg-6+deb9u5fixed
stretch (lts), stretch2.5.5~dfsg-6+deb9u9fixed
ring (PTS)stretch (security), stretch (lts), stretch20161221.2.7bd7d91~dfsg1-1+deb9u1vulnerable
buster (security), buster, buster (lts)20190215.1.f152c98~ds1-1+deb10u2fixed
bullseye20210112.2.b757bac~ds1-1vulnerable
bullseye (security)20210112.2.b757bac~ds1-1+deb11u1fixed
bookworm20230206.0~ds2-1.1fixed
sid20231201.0~ds1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
asterisksourcejessie(unfixed)end-of-life
asterisksourcestretch(not affected)
asterisksourcebuster1:16.28.0~dfsg-0+deb10u1DLA-3194-1
asterisksourcebullseye1:16.28.0~dfsg-0+deb11u1DSA-5285-1
asterisksource(unstable)1:18.12.0~dfsg+~cs6.12.40431413-1
pjprojectsourcejessie(unfixed)end-of-life
pjprojectsourcestretch2.5.5~dfsg-6+deb9u3DLA-2962-1
pjprojectsource(unstable)(unfixed)
ringsourcestretch(unfixed)end-of-life
ringsourcebuster20190215.1.f152c98~ds1-1+deb10u2DLA-3549-1
ringsourcebullseye20210112.2.b757bac~ds1-1+deb11u1DLA-3887-1
ringsource(unstable)20230206.0~ds1-11014998

Notes

[stretch] - asterisk <not-affected> (Vulnerable code not present)
https://github.com/pjsip/pjproject/security/advisories/GHSA-m66q-q64c-hv36
https://github.com/pjsip/pjproject/commit/22af44e68a0c7d190ac1e25075e1382f77e9397a

Search for package or bug name: Reporting problems