CVE-2022-21723

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the master branch. There are no known workarounds.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21723.json"
}

References

Affected packages

Git / github.com/asterisk/asterisk

Affected ranges

Type: GIT
Repo: https://github.com/asterisk/asterisk
Events: Introduced

a65908f83e2f17a3aca7eb39c8e06045aca02674

Fixed

c28961a7d88cf065f693d1ea412c3e2b35e6d18e

Git / github.com/pjsip/pjproject

Affected ranges

Type

GIT

Repo

https://github.com/pjsip/pjproject

Events

Introduced

Last affected

513700f74787009241a11eda125284277f7dfc1c

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.11.1"
        }
    ]
}

Affected versions

2.*

2.10

2.11

2.11.1