CVE-2022-24786

Опубликовано: 06 апр. 2022

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the master branch of the pjsip/pjproject GitHub repository. There are currently no known workarounds.

Ссылки

https://github.com/pjsip/pjproject/commit/11559e49e65bdf00922ad5ae28913ec6a198d508
Patch
Third Party Advisory
https://github.com/pjsip/pjproject/security/advisories/GHSA-vhxv-phmx-g52q
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202210-37
Third Party Advisory
https://www.debian.org/security/2022/dsa-5285
Third Party Advisory
https://github.com/pjsip/pjproject/commit/11559e49e65bdf00922ad5ae28913ec6a198d508
Patch
Third Party Advisory
https://github.com/pjsip/pjproject/security/advisories/GHSA-vhxv-phmx-g52q
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202210-37
Third Party Advisory
https://www.debian.org/security/2022/dsa-5285
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pjsip:pjsip:*:*:*:*:*:*:*:*

Версия до 2.12 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 48%

0.00245

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2022-24786

CVSS3: 9.8

ubuntu

около 3 лет назад

PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.

CVE-2022-24786

CVSS3: 9.8

debian

около 3 лет назад

PJSIP is a free and open source multimedia communication library writt ...

BDU:2022-03170

CVSS3: 9.8

fstec

около 3 лет назад

Уязвимость реализации функции pjmedia_rtcp_fb_parse_rpsi() мультимедийной коммуникационной библиотеки PJSIP, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании

ROS-20220518-03

redos

около 3 лет назад

Множественные уязвимости pjproject

EPSS

Процентиль: 48%

0.00245

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-125