PT-2022-1922 · Pjsip+4 · Pjsip+4

Published 2022-02-16 · Updated 2026-03-24 · CVE-2021-43302

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions PJSIP (affected versions not specified)

Description The issue is related to a buffer overflow error in the PJSUA API when calling the pjsua recorder create function. An attacker-controlled filename argument may cause an out-of-bounds read when the filename is shorter than 4 characters. This can allow a remote attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2024-15954

ALT-PU-2024-16030

BDU:2022-01458

CVE-2021-43302

DLA-2962-1

DLA-3194-1

DLA-3549-1

DLA-3887-1

DSA-5285-1

GHSA-QCVW-H34V-C7R9

USN-6422-1

USN-8122-1

Affected Products

Alt Linux

Linuxmint

Pjsip

Red Os

Ubuntu

References · 61

• https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9 · Patch
• https://bdu.fstec.ru/vul/2022-01458 · Security Note
• https://osv.dev/vulnerability/USN-6422-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24754 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2962-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39244 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8122-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-43302 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8122-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43302 · Security Note
• https://ubuntu.com/security/CVE-2018-1000098 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21723 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23547 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21722 · Vendor Advisory