CVE-2022-24786

Name	CVE-2022-24786
Description	PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3194-1, DSA-5285-1
Debian Bugs	1014976

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
asterisk (PTS)	jessie, jessie (lts)	1:11.13.1~dfsg-2+deb8u8	vulnerable
	stretch (security)	1:13.14.1~dfsg-2+deb9u6	fixed
	stretch (lts), stretch	1:13.14.1~dfsg-2+deb9u10	fixed
	buster, buster (lts)	1:16.28.0~dfsg-0+deb10u5	fixed
	buster (security)	1:16.28.0~dfsg-0+deb10u4	fixed
	bullseye	1:16.28.0~dfsg-0+deb11u4	fixed
	bullseye (security)	1:16.28.0~dfsg-0+deb11u5	fixed
	sid	1:22.0.0~dfsg+~cs6.14.60671435-1	fixed
pjproject (PTS)	jessie, jessie (lts)	2.1.0.0.ast20130823-1+deb8u1	vulnerable
	stretch (security)	2.5.5~dfsg-6+deb9u5	fixed
	stretch (lts), stretch	2.5.5~dfsg-6+deb9u9	fixed
ring (PTS)	stretch (security), stretch (lts), stretch	20161221.2.7bd7d91~dfsg1-1+deb9u1	vulnerable
	buster (security), buster, buster (lts)	20190215.1.f152c98~ds1-1+deb10u2	vulnerable
	bullseye	20210112.2.b757bac~ds1-1	vulnerable
	bullseye (security)	20210112.2.b757bac~ds1-1+deb11u1	vulnerable
	bookworm	20230206.0~ds2-1.1	fixed
	sid	20231201.0~ds1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
asterisk	source	jessie	(unfixed)	end-of-life
asterisk	source	stretch	(not affected)
asterisk	source	buster	1:16.28.0~dfsg-0+deb10u1		DLA-3194-1
asterisk	source	bullseye	1:16.28.0~dfsg-0+deb11u1		DSA-5285-1
asterisk	source	(unstable)	1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1			1014976
pjproject	source	jessie	(unfixed)	end-of-life
pjproject	source	stretch	(not affected)
pjproject	source	(unstable)	(unfixed)
ring	source	(unstable)	20230206.0~ds1-1	unimportant

Notes

[stretch] - asterisk <not-affected> (Vulnerable code not present)
[stretch] - pjproject <not-affected> (Vulnerable code not present)
code is present in ring but ring only uses the pjsip code, not pjmedia
https://github.com/pjsip/pjproject/security/advisories/GHSA-vhxv-phmx-g52q
https://github.com/pjsip/pjproject/commit/11559e49e65bdf00922ad5ae28913ec6a198d508