Buffer overflow in Pjsip Pjproject
CVE-2022-24754
PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP.
Vulnerability class: Buffer Overflow
EPSS: 0.021 (80.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Pjsip Pjproject — versions <= 2.12
- Teluu Pjsip
- Debian Debian_linux — versions 9.0
Weakness classification (CWE)
References
- security-advisories@github.com (Patch, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory)
- security-advisories@github.com (mailing-list, Mailing List, Third Party Advisory)
- security-advisories@github.com (vendor-advisory, Third Party Advisory)
- security-advisories@github.com (mailing-list)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2022-24754?
- CVE-2022-24754 is a high-severity vulnerability in Pjsip Pjproject, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 8.5/10. Published 2022-03-11.
- How severe is CVE-2022-24754?
- High severity. CVSS v3 base score is 8.5 out of 10.