Ubuntu.comUB:CVE-2022-21722CVE-2022-21722
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
0.003 Low
EPSS
Percentile
71.3%
PJSIP is a free and open source multimedia communication library written in
C language implementing standard based protocols such as SIP, SDP, RTP,
STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases
where it is possible that certain incoming RTP/RTCP packets can potentially
cause out-of-bound read access. This issue affects all users that use
PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in
the master branch. There are no known workarounds.
References
github.com/pjsip/pjproject/commit/22af44e68a0c7d190ac1e25075e1382f77e9397a
github.com/pjsip/pjproject/security/advisories/GHSA-m66q-q64c-hv36
launchpad.net/bugs/cve/CVE-2022-21722
nvd.nist.gov/vuln/detail/CVE-2022-21722
security-tracker.debian.org/tracker/CVE-2022-21722
ubuntu.com/security/notices/USN-6422-1
www.cve.org/CVERecord?id=CVE-2022-21722
Related
6.4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
0.003 Low
EPSS
Percentile
71.3%