← Back

CVE-2022-21723

nvd nist
Published: Jan 27, 2022Modified: Jun 17, 2026

JSON object

Loading...
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Exploitability: 3.9 / Impact: 5.2
Source: NVD

Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.

Affected (19)

Products: Teluu: Pjsip · Asterisk: Certified Asterisk · Sangoma: Asterisk · +1 more
Show all products
Teluu: Pjsip · Asterisk: Certified Asterisk · Sangoma: Asterisk · Debian: Debian Linux
Teluu
1 product
Pjsip
Asterisk
1 product
Certified Asterisk
Sangoma
1 product
Asterisk
Debian
1 product
Debian Linux
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Pjsip
Up to 2.11.1
Configuration B
16 vulnerable
Vulnerable SoftwareAffected Versions
Asterisk
Certified Asterisk
Version 16.8.0
Certified Asterisk
Version 16.8.0 cert10
Certified Asterisk
Version 16.8.0 cert11
Certified Asterisk
Version 16.8.0 cert12
Certified Asterisk
Version 16.8.0 cert1
Certified Asterisk
Version 16.8.0 cert2
Certified Asterisk
Version 16.8.0 cert3
Certified Asterisk
Version 16.8.0 cert4
Certified Asterisk
Version 16.8.0 cert5
Certified Asterisk
Version 16.8.0 cert6
Certified Asterisk
Version 16.8.0 cert7
Certified Asterisk
Version 16.8.0 cert8
Certified Asterisk
Version 16.8.0 cert9
Sangoma
Asterisk
From 16.0.0 to 16.24.1
Asterisk
From 18.0.0 to 18.10.1
Asterisk
From 19.0.0 to 19.2.1
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Debian
Debian Linux
Version 10.0
Debian Linux
Version 9.0

Related CWEs

CWE-125
Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.

References (19)

Source: security-advisories@github.com
Third Party AdvisoryVDB Entry
Source: security-advisories@github.com
Mailing ListPatchThird Party Advisory
Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
Mailing ListThird Party Advisory
Source: security-advisories@github.com
Mailing ListThird Party Advisory
Source: security-advisories@github.com
Source: security-advisories@github.com
Third Party Advisory
Source: security-advisories@github.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.