CVE-2022-21723

CRITICAL
Published Jan 27, 20224y ago · Modified Jun 17, 20262w ago
9.1 CVSS 3.1
Critical
Find Similar
Published Jan 27, 2022 4y ago
Last Modified Jun 17, 2026 2w ago

Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.

CVSS Details

Base Score
9.1
Exploitability
3.9
Impact
5.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 19

VendorProductVersionRange
teluupjsip* ≤2.11.1
asteriskcertified_asterisk16.8.0any
asteriskcertified_asterisk16.8.0any
asteriskcertified_asterisk16.8.0any
asteriskcertified_asterisk16.8.0any
asteriskcertified_asterisk16.8.0any
asteriskcertified_asterisk16.8.0any
asteriskcertified_asterisk16.8.0any
asteriskcertified_asterisk16.8.0any
asteriskcertified_asterisk16.8.0any
asteriskcertified_asterisk16.8.0any
asteriskcertified_asterisk16.8.0any
asteriskcertified_asterisk16.8.0any
asteriskcertified_asterisk16.8.0any
sangomaasterisk*≥16.0.0  –  <16.24.1
sangomaasterisk*≥18.0.0  –  <18.10.1
sangomaasterisk*≥19.0.0  –  <19.2.1
debiandebian_linux9.0any
debiandebian_linux10.0any

References 10

  • packetstormsecurity.com http://packetstormsecurity.com/files/166227/Asterisk-Project-Security-Advisory-AST-2022-006.html
    Third Party AdvisoryVDB Entry
  • seclists.org http://seclists.org/fulldisclosure/2022/Mar/2
    Mailing ListPatchThird Party Advisory
  • github.com https://github.com/pjsip/pjproject/commit/077b465c33f0aec05a49cd2ca456f9a1b112e896
    PatchThird Party Advisory
  • github.com https://github.com/pjsip/pjproject/security/advisories/GHSA-7fw8-54cv-r7pm
    PatchThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
    Mailing ListThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
    Mailing ListThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
  • security.gentoo.org https://security.gentoo.org/glsa/202210-37
    Third Party Advisory
  • debian.org https://www.debian.org/security/2022/dsa-5285
    Third Party Advisory

Remediation

  • seclists.org http://seclists.org/fulldisclosure/2022/Mar/2
    Mailing ListPatchThird Party Advisory
  • github.com https://github.com/pjsip/pjproject/commit/077b465c33f0aec05a49cd2ca456f9a1b112e896
    PatchThird Party Advisory
  • github.com https://github.com/pjsip/pjproject/security/advisories/GHSA-7fw8-54cv-r7pm
    PatchThird Party Advisory