cbcvebase.
CVE-2022-31031
published 2022-06-09

CVE-2022-31031: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN…

PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.81%
75.9th percentile
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their applications, either by: setting a STUN server in their account/media config in PJSUA/PJSUA2 level, or directly using `pjlib-util/stun_simple` API. A patch is available in commit 450baca which should be included in the next release. There are no known workarounds for this issue.

Affected

6 ranges
VendorProductVersion rangeFixed in
debianasterisk< asterisk 1:16.28.0~dfsg-0+deb11u2 (bullseye)asterisk 1:16.28.0~dfsg-0+deb11u2 (bullseye)
debiandebian_linux
debiandebian_linux
debianring< asterisk 1:16.28.0~dfsg-0+deb11u2 (bullseye)asterisk 1:16.28.0~dfsg-0+deb11u2 (bullseye)
pjsippjproject<= 2.12.1
teluupjsip<= 2.12.1

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability is triggered via STUN usage in PJSIP — monitor for STUN traffic or STUN server configuration in PJSUA/PJSUA2 account/media config, or direct use of the `pjlib-util/stun_simple` API
  • Target versions for detection/patching: PJSIP versions prior to and including 2.12.1 are vulnerable; patch is present in commit 450baca
  • ·Scope is listed as local in the Debian security tracker, which may limit remote exploitability assessments — verify exposure based on whether STUN server is configured externally

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_ubuntu7.3HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.