CVE-2022-21723
27.01.2022, 00:15
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.Enginsight
Vendor | Product | Version |
---|---|---|
teluu | pjsip | 𝑥 ≤ 2.11.1 |
asterisk | certified_asterisk | 16.8.0 |
asterisk | certified_asterisk | 16.8.0:cert1 |
asterisk | certified_asterisk | 16.8.0:cert10 |
asterisk | certified_asterisk | 16.8.0:cert11 |
asterisk | certified_asterisk | 16.8.0:cert12 |
asterisk | certified_asterisk | 16.8.0:cert2 |
asterisk | certified_asterisk | 16.8.0:cert3 |
asterisk | certified_asterisk | 16.8.0:cert4 |
asterisk | certified_asterisk | 16.8.0:cert5 |
asterisk | certified_asterisk | 16.8.0:cert6 |
asterisk | certified_asterisk | 16.8.0:cert7 |
asterisk | certified_asterisk | 16.8.0:cert8 |
asterisk | certified_asterisk | 16.8.0:cert9 |
sangoma | asterisk | 16.0.0 ≤ 𝑥 < 16.24.1 |
sangoma | asterisk | 18.0.0 ≤ 𝑥 < 18.10.1 |
sangoma | asterisk | 19.0.0 ≤ 𝑥 < 19.2.1 |
debian | debian_linux | 9.0 |
debian | debian_linux | 10.0 |
𝑥
= Vulnerable software versions

Debian Releases
Debian Product | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
asterisk |
| ||||||||||
ring |
|

Ubuntu Releases
Common Weakness Enumeration
References