cbcvebase.
CVE-2022-21723
published 2022-01-27

CVE-2022-21723: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN…

PriorityP357critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
4.48%
90.3th percentile
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.

Affected

11 ranges
VendorProductVersion rangeFixed in
asteriskcertified_asterisk
debianasterisk< asterisk 1:16.28.0~dfsg-0+deb11u1 (bullseye)asterisk 1:16.28.0~dfsg-0+deb11u1 (bullseye)
debiandebian_linux
debiandebian_linux
debianring< asterisk 1:16.28.0~dfsg-0+deb11u1 (bullseye)asterisk 1:16.28.0~dfsg-0+deb11u1 (bullseye)
pjsippjproject<= 2.11.1
sangomaasterisk>= 0 < 1:16.28.0~dfsg-0+deb11u11:16.28.0~dfsg-0+deb11u1
sangomaasterisk>= 16.0.0 < 16.24.116.24.1
sangomaasterisk>= 18.0.0 < 18.10.118.10.1
sangomaasterisk>= 19.0.0 < 19.2.119.2.1
teluupjsip<= 2.11.1

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
osv9.8CRITICAL
vendor_debian9.1CRITICAL
vendor_ubuntu7.3HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.