Vulnerability Description
PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pjsip | Pjsip | <= 2.12 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- https://github.com/pjsip/pjproject/commit/11559e49e65bdf00922ad5ae28913ec6a198d5PatchThird Party Advisory
- https://github.com/pjsip/pjproject/security/advisories/GHSA-vhxv-phmx-g52qThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202210-37Third Party Advisory
- https://www.debian.org/security/2022/dsa-5285Third Party Advisory
- https://github.com/pjsip/pjproject/commit/11559e49e65bdf00922ad5ae28913ec6a198d5PatchThird Party Advisory
- https://github.com/pjsip/pjproject/security/advisories/GHSA-vhxv-phmx-g52qThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.htmlMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202210-37Third Party Advisory
- https://www.debian.org/security/2022/dsa-5285Third Party Advisory
FAQ
What is CVE-2022-24786?
CVE-2022-24786 is a vulnerability with a CVSS score of 9.8 (CRITICAL). PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, b...
How severe is CVE-2022-24786?
CVE-2022-24786 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-24786?
Check the references section above for vendor advisories and patch information. Affected products include: Pjsip Pjsip, Debian Debian Linux.