CVE-2022-39269: teluu pjsip

csirt@kutim:~/threat-intel/cve/CVE-2022-39269

CVSS 9.1 · Critical EPSS 0,73%

Kerentanan Cleartext Transmission of Sensitive Information pada teluu pjsip. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP. The patch is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 6 Oktober 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-319: Cleartext Transmission of Sensitive Information
EPSS (30 hari): 0,73% peluang dieksploitasi; lebih tinggi dari 52,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
teluu	pjsip	Versi 2.11 hingga sebelum 2.13

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/pjsip/pjproject/commit/d2acb9af4e27b5ba75d658690406cec9c274c5cc patch · advisory pihak ketiga
https://github.com/pjsip/pjproject/security/advisories/GHSA-wx5m-cj97-4wwg advisory pihak ketiga
https://security.gentoo.org/glsa/202210-37 advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html
https://www.debian.org/security/2023/dsa-5358

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.