CVE-2022-24763
high
CVSS v3
7.5
CVSS v4 NEW
—
VIR risk
7.5
Description
PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds.
Predictions
Exploit likelihood
83%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
Source: GitHub Security Advisory · View original ↗ · CC-BY-4.0
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bullseye | fixed | 1:16.28.0~dfsg-0+deb11u1 |
| debian | sid | fixed | 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1 |
| debian | 9.0 | affected | |
| debian | 10.0 | affected | |
| debian | 11.0 | affected | |
| debian | bookworm | fixed | 20230206.0~ds1-1 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| teluu | pjsip | {"startIncluding":"2.5","endExcluding":"2.13"} | 2.13 |
References
- https://security-tracker.debian.org/tracker/CVE-2022-24763
- https://github.com/pjsip/pjproject/commit/856f87c2e97a27b256482dbe0d748b1194355a21
- https://github.com/pjsip/pjproject/security/advisories/GHSA-5x45-qp78-g4p4
- https://lists.debian.org/debian-lts-announce/2022/05/msg00047.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://security.gentoo.org/glsa/202210-37
- https://www.debian.org/security/2022/dsa-5285
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
CWEs
CWE-835
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.