CVE-2022-21722criticalCWE-125

CVE-2022-21722: critical vulnerability in pjsip pjproject

Potential out-of-bound read during RTP/RTCP parsing in PJSIP

Published · Updated

Follow this CVE+ Monitor pjproject+ Monitor asterisk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 2.3%
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected products
pjsip · pjproject
Related CVEs — pjsip pjproject

In the same product, most dangerous first.

CVE-2021-37706HIGHPotential integer underflow upon receiving STUN message in PJSIPEPSS 4.9%CVE-2022-21723CRITICALOut-of-bounds read in multipart parsing in PJSIPEPSS 4.4%CVE-2022-23608HIGHUse after free in PJSIPEPSS 4.0%CVE-2021-43845HIGHPrevent out-of-bounds read in PJSIPEPSS 3.9%CVE-2022-24764HIGHStack buffer overflow in pjprojectEPSS 2.4%CVE-2023-27585HIGHCVE-2023-27585EPSS 2.3%