critique
CVE-2022-24754
PJSIP is a free and open source multimedia communication library writt ...
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Ubuntu (moyenne).
Description
PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.16 | pjproject | 2.12.1-r0 |
| alpine 3.17 | pjproject | 2.12.1-r0 |
| alpine 3.18 | pjproject | 2.12.1-r0 |
| alpine 3.19 | pjproject | 2.12.1-r0 |
| alpine 3.20 | pjproject | 2.12.1-r0 |
| alpine 3.21 | pjproject | 2.12.1-r0 |
| alpine 3.22 | pjproject | 2.12.1-r0 |
| alpine 3.23 | pjproject | 2.12.1-r0 |
| alpine 3.24 | pjproject | 2.12.1-r0 |
| alpine edge | pjproject | 2.12.1-r0 |
| debian 10 | ring | 20190215.1.f152c98~ds1-1+deb10u2 |
| debian 11 | ring | 20210112.2.b757bac~ds1-1+deb11u1 |
Afficher les 19 entrées de 18 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.16 | pjproject | 2.12.1-r0 |
| alpine 3.17 | pjproject | 2.12.1-r0 |
| alpine 3.18 | pjproject | 2.12.1-r0 |
| alpine 3.19 | pjproject | 2.12.1-r0 |
| alpine 3.20 | pjproject | 2.12.1-r0 |
| alpine 3.21 | pjproject | 2.12.1-r0 |
| alpine 3.22 | pjproject | 2.12.1-r0 |
| alpine 3.23 | pjproject | 2.12.1-r0 |
| alpine 3.24 | pjproject | 2.12.1-r0 |
| alpine edge | pjproject | 2.12.1-r0 |
| debian 10 | ring | 20190215.1.f152c98~ds1-1+deb10u2 |
| debian 11 | ring | 20210112.2.b757bac~ds1-1+deb11u1 |
| debian 12 | ring | 20230206.0~ds1-1 |
| debian 9 | pjproject | 2.5.5~dfsg-6+deb9u3 |
| echo | ring | 20230206.0~ds1-1 |
| ubuntu 18.04-ESM | pjproject | pas de correctif indiqué |
| ubuntu 18.04-ESM | ring | 20180228.1.503da2b~ds1-1ubuntu0.1~esm1 |
| ubuntu 20.04 | ring | 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 |
| ubuntu 20.04-ESM | ring | 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 |
Références
- https://github.com/pjsip/pjproject/commit/d27f79da11df7bc8bb56c2f291d71e54df8d2c47
- https://github.com/pjsip/pjproject/security/advisories/GHSA-73f7-48m9-w662
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
- https://security.gentoo.org/glsa/202210-37
- https://ubuntu.com/security/notices/USN-6422-1
- https://www.cve.org/CVERecord?id=CVE-2022-24754