CVE-2022-23537: Buffer Overread Vulnerability in PJSIP
Summary
CVE-2022-23547: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Affects asterisk across 2 version ranges.
< 18.20.2-r0
< d8440f4d711a654b511f50f79c0445b26f9dd1e1
Fixed in 18.20.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PJSIP is a free and open source multimedia communication library written in C language. It implements standard-based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. PJSIP is widely used in applications that require multimedia communication capabilities. However, a buffer overread vulnerability has been discovered in PJSIP when parsing a specially crafted STUN message with an unknown attribute. This vulnerability affects applications that utilize STUN, including PJNATH and PJSUA-LIB.
Vulnerability Detail
The buffer overread vulnerability in PJSIP allows an attacker to exploit a flaw in the parsing of STUN messages. By sending a specially crafted STUN message with an unknown attribute, an attacker can trigger a buffer overread, potentially leading to information disclosure or denial of service. This vulnerability has a CVSS score of 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
18.20.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the patch or update the PJSIP library to mitigate the risk.
Conclusion
The buffer overread vulnerability in PJSIP can be mitigated by updating the PJSIP library to the latest version. Developers should apply the provided patch to ensure the security of their applications. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for asterisk →
FAQ
PJSIP is a free and open source multimedia communication library written in C language. It implements standard-based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.
Applications that utilize STUN, including PJNATH and PJSUA-LIB, are affected by this vulnerability.
The buffer overread vulnerability in PJSIP can potentially lead to information disclosure or denial of service.
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
To fix this vulnerability, update the PJSIP library to the latest version that includes the patch for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
