CVE-2022-21723 Out-of-bounds read in multipart parsing in PJSIP
Attackers can trigger out-of-bounds reads in PJSIP by sending malformed SIP multipart messages, potentially causing crashes or data leaks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21723?
CVE-2022-21723 is a critical memory corruption vulnerability in Debian Debian Linux, published on 27 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.
Weakness: CWE-125
Which versions are affected by CVE-2022-21723?
It affects 4 products.
Products include Asterisk Certified Asterisk, Debian Debian Linux, Sangoma Asterisk, Teluu Pjsip.
How do I fix CVE-2022-21723?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-21723 being exploited?
There is no known exploitation of CVE-2022-21723 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2022-21723, DEBIAN-CVE-2022-21723, GHSA-7fw8-54cv-r7pm, UBUNTU-CVE-2022-21723.