PT-2022-2174 · Pjsip+3 · Pjsip+3

Sauwming · Published 2022-01-26 · Updated 2025-11-04 · CVE-2022-21722

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions PJSIP versions 2.11.1 and prior

Description The issue is related to a buffer overflow in memory when handling RTP/RTCP packets, which can be exploited by a remote attacker to cause a denial of service. PJSIP is a free and open source multimedia communication library that implements standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. The problem affects all users that use PJMEDIA and accept incoming RTP/RTCP packets.

Recommendations For PJSIP versions 2.11.1 and prior, update to a version that includes the patch available as a commit in the master branch to resolve the issue. As a temporary workaround, consider restricting the acceptance of incoming RTP/RTCP packets until the patch is applied.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2024-15954

ALT-PU-2024-16030

BDU:2022-02185

CVE-2022-21722

DLA-2962-1

DLA-3194-1

DLA-3549-1

DLA-3887-1

DSA-5285-1

GHSA-M66Q-Q64C-HV36

USN-6422-1

Affected Products

Alt Linux

Linuxmint

Pjsip

Ubuntu

References · 53

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21722.json · Exploit
• https://github.com/pjsip/pjproject/commit/22af44e68a0c7d190ac1e25075e1382f77e9397a · Patch
• https://github.com/pjsip/pjproject/security/advisories/GHSA-m66q-q64c-hv36 · Patch
• https://osv.dev/vulnerability/USN-6422-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24754 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39244 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2962-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21723 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23547 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21722 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-21722 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31031 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24793 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3194-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-21722 · Vendor Advisory