crítica
CVE-2022-24754
PJSIP is a free and open source multimedia communication library writt ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Ubuntu (media).
Descripción
PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.16 | pjproject | 2.12.1-r0 |
| alpine 3.17 | pjproject | 2.12.1-r0 |
| alpine 3.18 | pjproject | 2.12.1-r0 |
| alpine 3.19 | pjproject | 2.12.1-r0 |
| alpine 3.20 | pjproject | 2.12.1-r0 |
| alpine 3.21 | pjproject | 2.12.1-r0 |
| alpine 3.22 | pjproject | 2.12.1-r0 |
| alpine 3.23 | pjproject | 2.12.1-r0 |
| alpine 3.24 | pjproject | 2.12.1-r0 |
| alpine edge | pjproject | 2.12.1-r0 |
| debian 10 | ring | 20190215.1.f152c98~ds1-1+deb10u2 |
| debian 11 | ring | 20210112.2.b757bac~ds1-1+deb11u1 |
Mostrar las 19 entradas de 18 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.16 | pjproject | 2.12.1-r0 |
| alpine 3.17 | pjproject | 2.12.1-r0 |
| alpine 3.18 | pjproject | 2.12.1-r0 |
| alpine 3.19 | pjproject | 2.12.1-r0 |
| alpine 3.20 | pjproject | 2.12.1-r0 |
| alpine 3.21 | pjproject | 2.12.1-r0 |
| alpine 3.22 | pjproject | 2.12.1-r0 |
| alpine 3.23 | pjproject | 2.12.1-r0 |
| alpine 3.24 | pjproject | 2.12.1-r0 |
| alpine edge | pjproject | 2.12.1-r0 |
| debian 10 | ring | 20190215.1.f152c98~ds1-1+deb10u2 |
| debian 11 | ring | 20210112.2.b757bac~ds1-1+deb11u1 |
| debian 12 | ring | 20230206.0~ds1-1 |
| debian 9 | pjproject | 2.5.5~dfsg-6+deb9u3 |
| echo | ring | 20230206.0~ds1-1 |
| ubuntu 18.04-ESM | pjproject | sin corrección indicada |
| ubuntu 18.04-ESM | ring | 20180228.1.503da2b~ds1-1ubuntu0.1~esm1 |
| ubuntu 20.04 | ring | 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 |
| ubuntu 20.04-ESM | ring | 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 |
Referencias
- https://github.com/pjsip/pjproject/commit/d27f79da11df7bc8bb56c2f291d71e54df8d2c47
- https://github.com/pjsip/pjproject/security/advisories/GHSA-73f7-48m9-w662
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
- https://security.gentoo.org/glsa/202210-37
- https://ubuntu.com/security/notices/USN-6422-1
- https://www.cve.org/CVERecord?id=CVE-2022-24754