CVE-2022-21722

Katalog CVE

CVSS 9.1 · Critical EPSS 2,3%

Kerentanan Out-of-bounds Read pada teluu pjsip, debian linux. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.

Rincian

Terbit di NVD

27 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 83,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pjsip/pjproject/commit/22af44e68a0c7d190ac1e25075e1382f77e9397a patch · advisory pihak ketiga
• https://github.com/pjsip/pjproject/security/advisories/GHSA-m66q-q64c-hv36 patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202210-37 advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5285 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html