CVE-2022-24754

PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP.
Configurations

Configuration 1 (hide)

cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

History

03 Jul 2023, 20:35

Type Values Removed Values Added
CWE CWE-120 CWE-1284
References (GENTOO) https://security.gentoo.org/glsa/202210-37 - (GENTOO) https://security.gentoo.org/glsa/202210-37 - Third Party Advisory

31 Oct 2022, 22:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202210-37 -

05 Jun 2022, 02:46

Type Values Removed Values Added
CPE cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
References (MLIST) https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - (MLIST) https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html - Mailing List, Third Party Advisory

28 Mar 2022, 17:15

Type Values Removed Values Added
CWE CWE-787 CWE-120
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html -

23 Mar 2022, 12:56

Type Values Removed Values Added
CWE CWE-120 CWE-787
CPE cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*
References (MISC) https://github.com/pjsip/pjproject/commit/d27f79da11df7bc8bb56c2f291d71e54df8d2c47 - (MISC) https://github.com/pjsip/pjproject/commit/d27f79da11df7bc8bb56c2f291d71e54df8d2c47 - Patch, Third Party Advisory
References (CONFIRM) https://github.com/pjsip/pjproject/security/advisories/GHSA-73f7-48m9-w662 - (CONFIRM) https://github.com/pjsip/pjproject/security/advisories/GHSA-73f7-48m9-w662 - Patch, Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : 7.5
v3 : 9.8

11 Mar 2022, 20:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-03-11 20:15

Updated : 2024-02-04 22:29


NVD link : CVE-2022-24754

Mitre link : CVE-2022-24754

CVE.ORG link : CVE-2022-24754


JSON object : View

Products Affected

teluu

  • pjsip

debian

  • debian_linux
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-1284

Improper Validation of Specified Quantity in Input