{"id":"CVE-2022-21722","aliases":["ALPINE-CVE-2022-21722","DEBIAN-CVE-2022-21722","DLA-2962-1","DLA-3194-1","DLA-3549-1","DLA-3887-1","DSA-5285-1","EUVD-2022-26904","GHSA-m66q-q64c-hv36","UBUNTU-CVE-2022-21722","USN-6422-1"],"status":"published","title":"Potential out-of-bound read during RTP/RTCP parsing in PJSIP","description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02339,"percentile":0.83725,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2022-01-27T00:00:00Z","modified":"2026-11-03T08:02:53Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"pjproject","fixed_in":["2.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"pjproject","fixed_in":["2.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"pjproject","fixed_in":["2.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"pjproject","fixed_in":["2.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"pjproject","fixed_in":["2.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"pjproject","fixed_in":["2.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"pjproject","fixed_in":["2.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"pjproject","fixed_in":["2.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"pjproject","fixed_in":["2.12-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"asterisk","fixed_in":["1:18.12.0~dfsg+~cs6.12.40431413-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ring","fixed_in":["20230206.0~ds1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ring","fixed_in":["20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"pjproject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"pjproject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"pjproject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"pjproject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"pjproject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"pjproject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"pjproject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"pjproject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"pjproject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12-r0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"asterisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.12.0~dfsg+~cs6.12.40431413-1"}]}],"versions":["0.1.11-3","0.1.11-3woody1","1:1.0.5-2","1:1.0.5-4","1:1.0.6-1","1:1.0.6-2","1:1.0.7-1","1:1.0.7.dfsg.1-1","1:1.0.7.dfsg.1-2","1:1.0.7.dfsg.1-2sarge1","1:1.0.7.dfsg.1-2sarge2","1:1.0.7.dfsg.1-2sarge3","1:1.0.7.dfsg.1-2sarge4","1:1.0.7.dfsg.1-2sarge5","1:1.0.7.dfsg.1-2sarge6","1:1.0.9.dfsg-1","1:1.0.9.dfsg-3","1:1.0.9.dfsg-4","1:1.0.9.dfsg-5","1:1.0.9.dfsg-6","1:1.2.0-beta1.dfsg-1","1:1.2.0-beta2.dfsg-1","1:1.2.0-beta2.dfsg-2","1:1.2.0-beta2.dfsg-3","1:1.2.0-rc1.dfsg-1","1:1.2.0-rc2.dfsg-1","1:1.2.0.dfsg-1","1:1.2.0.dfsg-2","1:1.2.0.dfsg-3","1:1.2.0.dfsg-4","1:1.2.0.dfsg-5","1:1.2.0.dfsg-6","1:1.2.1.dfsg-1","1:1.2.1.dfsg-2","1:1.2.1.dfsg-3","1:1.2.10.dfsg-1","1:1.2.10.dfsg-1bpo1","1:1.2.10.dfsg-2","1:1.2.10.dfsg-3","1:1.2.11.dfsg-1","1:1.2.12.1.dfsg-1","1:1.2.13~dfsg-1","1:1.2.13~dfsg-2","1:1.2.13~dfsg-2etch1","1:1.2.13~dfsg-2etch2","1:1.2.13~dfsg-2etch3","1:1.2.13~dfsg-2etch4","1:1.2.14~dfsg-1","1:1.2.14~dfsg-2","1:1.2.14~dfsg-3","1:1.2.14~dfsg-4","1:1.2.15~dfsg-1","1:1.2.16~dfsg-1","1:1.2.17~dfsg-1","1:1.2.4.dfsg-1","1:1.2.4.dfsg-2","1:1.2.4.dfsg-3","1:1.2.4.dfsg-4","1:1.2.4.dfsg-5","1:1.2.4.dfsg-6","1:1.2.4.dfsg-6+b1","1:1.2.4.dfsg-7","1:1.2.7.1.dfsg-1","1:1.2.7.1.dfsg-2","1:1.2.7.1.dfsg-3","1:1.2.9.1.dfsg-1","1:1.4.10~dfsg-1","1:1.4.11~dfsg-1","1:1.4.11~dfsg-2","1:1.4.11~dfsg-3","1:1.4.11~dfsg-4","1:1.4.13~dfsg-1","1:1.4.15~dfsg-1","1:1.4.16.2~dfsg-1","1:1.4.16.2~dfsg-2","1:1.4.17~dfsg-1","1:1.4.17~dfsg-2","1:1.4.18.1~dfsg-1","1:1.4.18~dfsg-1","1:1.4.19.1~dfsg-1","1:1.4.20~dfsg-1","1:1.4.21.1~dfsg-1","1:1.4.21.2~dfsg-1","1:1.4.21.2~dfsg-2","1:1.4.21.2~dfsg-3","1:1.4.21.2~dfsg-3+lenny1","1:1.4.21.2~dfsg-3+lenny2","1:1.4.21.2~dfsg-3+lenny2.1","1:1.4.21.2~dfsg-3+lenny3","1:1.4.21.2~dfsg-3+lenny5","1:1.4.21.2~dfsg-3+lenny6","1:1.4.21.2~dfsg-3.1","1:1.4.2~dfsg-1","1:1.4.2~dfsg-2","1:1.4.2~dfsg-3","1:1.4.2~dfsg-4","1:1.4.2~dfsg-5","1:1.4.3~dfsg-1","1:1.4.4~dfsg-1","1:1.4.4~dfsg-2","1:1.4.4~dfsg-3","1:1.4.5~dfsg-1","1:1.4.6~dfsg-1","1:1.4.8~dfsg-1","1:1.4.8~dfsg-2","1:1.4.9~dfsg-1","1:1.6.1.0~dfsg-1","1:1.6.1.0~dfsg~rc3-1","1:1.6.2.0-1","1:1.6.2.0~dfsg~beta3-1","1:1.6.2.0~dfsg~rc1-1","1:1.6.2.0~rc3-1","1:1.6.2.0~rc3-2","1:1.6.2.0~rc6-1","1:1.6.2.0~rc7-1","1:1.6.2.2-1","1:1.6.2.6-1","1:1.6.2.7-1","1:1.6.2.9-1","1:1.6.2.9-1~bpo50+1","1:1.6.2.9-1~bpo50+2","1:1.6.2.9-1~bpo50+3","1:1.6.2.9-2","1:1.6.2.9-2+squeeze1","1:1.6.2.9-2+squeeze10","1:1.6.2.9-2+squeeze11","1:1.6.2.9-2+squeeze12","1:1.6.2.9-2+squeeze2","1:1.6.2.9-2+squeeze3","1:1.6.2.9-2+squeeze4","1:1.6.2.9-2+squeeze5","1:1.6.2.9-2+squeeze6","1:1.6.2.9-2+squeeze7","1:1.6.2.9-2+squeeze8","1:1.6.2.9-2+squeeze9","1:1.8.10.0~dfsg-1","1:1.8.10.1~dfsg-1","1:1.8.11.1~dfsg-1","1:1.8.13.0~dfsg-1","1:1.8.13.0~dfsg-1~bpo60+1","1:1.8.13.1~dfsg-1","1:1.8.13.1~dfsg-1+powerpcspe1","1:1.8.13.1~dfsg-1~bpo60+1","1:1.8.13.1~dfsg-2","1:1.8.13.1~dfsg-3","1:1.8.3.3-1","1:1.8.4-1","1:1.8.4.2-1","1:1.8.4.3-1","1:1.8.4.4~dfsg-1","1:1.8.4.4~dfsg-2","1:1.8.7.1~dfsg-1","1:1.8.7.1~dfsg-2","1:1.8.7.1~dfsg-3","1:1.8.8.0~dfsg-1","1:1.8.8.2~dfsg-1","1:11.10.0~dfsg-1","1:11.10.0~dfsg-1~bpo70+1","1:11.10.2~dfsg-1","1:11.10.2~dfsg-1~bpo70+1","1:11.11.0~dfsg-1","1:11.11.0~dfsg-1~bpo70+1","1:11.11.0~dfsg-2","1:11.12.0~dfsg-1","1:11.12.0~dfsg-1~bpo70+1","1:11.12.1~dfsg-1","1:11.13.0~dfsg-1","1:11.13.0~dfsg-1~bpo70+1","1:11.13.1~dfsg-1","1:11.13.1~dfsg-2","1:11.13.1~dfsg-2~bpo70+1","1:11.5.1~dfsg-1","1:11.5.1~dfsg-2","1:11.5.1~dfsg1-1","1:11.5.1~dfsg1-1~bpo70+1","1:11.6.0~dfsg-1","1:11.6.0~dfsg-2","1:11.6.0~dfsg-3","1:11.7.0~dfsg-1","1:11.7.0~dfsg-1+e1","1:11.7.0~dfsg-1~bpo70+1","1:11.8.0~dfsg-1","1:11.8.0~dfsg-2","1:11.8.1~dfsg-1","1:11.8.1~dfsg-1~bpo70+1","1:11.9.0~dfsg-1","1:11.9.0~dfsg-2","1:11.9.0~dfsg-2~bpo70+1","1:13.0.0~dfsg-1","1:13.0.0~dfsg-2","1:13.1.0~dfsg-1","1:13.1.0~dfsg-1.1","1:13.10.0~dfsg-1","1:13.11.2~dfsg-1","1:13.12.1~dfsg-1","1:13.12.2~dfsg-1","1:13.12.2~dfsg-2","1:13.13.1~dfsg-1","1:13.13.1~dfsg-2","1:13.13.1~dfsg-3","1:13.13.1~dfsg-3~exp1","1:13.13.1~dfsg-4","1:13.14.0~dfsg-1","1:13.14.0~dfsg-1~exp1","1:13.14.1~dfsg-1","1:13.14.1~dfsg-2","1:13.17.0~dfsg-1","1:13.17.0~dfsg-2","1:13.17.1~dfsg-1","1:13.17.2~dfsg-1","1:13.17.2~dfsg-2","1:13.18.1~dfsg-1","1:13.18.3~dfsg-1","1:13.18.5~dfsg-1","1:13.20.0~dfsg-1","1:13.22.0~dfsg-1","1:13.22.0~dfsg-2","1:13.23.1~dfsg-1","1:13.23.1~dfsg-2","1:13.7.2~dfsg-1","1:13.8.0~dfsg-1","1:13.8.2~dfsg-1","1:13.9.1~dfsg-1","1:13.9.1~dfsg-2","1:16.1.0~dfsg-1","1:16.1.0~dfsg-2","1:16.1.0~dfsg-3","1:16.1.0~dfsg-4","1:16.1.1~dfsg-1","1:16.10.0~dfsg-1","1:16.12.0~dfsg-1","1:16.15.0~dfsg-1","1:16.15.1~dfsg-1","1:16.16.1~dfsg+~2.10-1","1:16.16.1~dfsg+~2.10-2","1:16.16.1~dfsg-1","1:16.16.1~dfsg-1~bpo10+1","1:16.16.1~dfsg-2","1:16.16.1~dfsg-3","1:16.16.1~dfsg-4","1:16.2.0~dfsg-1","1:16.2.1~dfsg-1","1:16.2.1~dfsg-2","1:16.23.0~dfsg+~2.10-1","1:16.23.0~dfsg+~cs6.10.20220309-1","1:16.23.0~dfsg+~cs6.10.20220309-2","1:16.23.0~dfsg+~cs6.10.40431411-1","1:18.10.0~dfsg+~cs6.10.40431411-1","1:18.10.0~dfsg+~cs6.10.40431411-2","1:18.10.1~dfsg+~cs6.10.40431411-1","1:18.11.1~dfsg+~cs6.10.40431413-1","1:18.11.2~dfsg+~cs6.10.40431413-1","1:18.9.0~dfsg+~cs6.10.40431411-1"]},{"source":"osv","ecosystem":"Debian:12","package":"ring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230206.0~ds1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"pjproject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5~dfsg-6+deb9u3"}]}],"versions":["2.5.5~dfsg-6","2.5.5~dfsg-6+deb9u1","2.5.5~dfsg-6+deb9u2"],"bundled":15},{"source":"osv","ecosystem":"Debian:10","package":"asterisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.28.0~dfsg-0+deb10u1"}]}],"versions":["1:16.10.0~dfsg-1","1:16.12.0~dfsg-1","1:16.15.0~dfsg-1","1:16.15.1~dfsg-1","1:16.16.1~dfsg+~2.10-1","1:16.16.1~dfsg+~2.10-2","1:16.16.1~dfsg-1","1:16.16.1~dfsg-1~bpo10+1","1:16.16.1~dfsg-2","1:16.16.1~dfsg-3","1:16.16.1~dfsg-4","1:16.2.1~dfsg-1","1:16.2.1~dfsg-1+deb10u1","1:16.2.1~dfsg-1+deb10u2","1:16.2.1~dfsg-2","1:16.23.0~dfsg+~2.10-1","1:16.23.0~dfsg+~cs6.10.20220309-1","1:16.23.0~dfsg+~cs6.10.20220309-2","1:16.23.0~dfsg+~cs6.10.40431411-1"],"bundled":20},{"source":"osv","ecosystem":"Debian:10","package":"ring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190215.1.f152c98~ds1-1+deb10u2"}]}],"versions":["20190215.1.f152c98~ds1-1","20190215.1.f152c98~ds1-1+deb10u1"],"bundled":20},{"source":"osv","ecosystem":"Debian:11","package":"ring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20210112.2.b757bac~ds1-1+deb11u1"}]}],"versions":["20210112.2.b757bac~ds1-1"],"bundled":21},{"source":"osv","ecosystem":"Debian:11","package":"asterisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.28.0~dfsg-0+deb11u1"}]}],"versions":["1:16.16.1~dfsg+~2.10-1","1:16.16.1~dfsg+~2.10-2","1:16.16.1~dfsg-1","1:16.16.1~dfsg-1+deb11u1","1:16.16.1~dfsg-1+deb11u1~bpo10+1","1:16.16.1~dfsg-2","1:16.16.1~dfsg-3","1:16.16.1~dfsg-4","1:16.23.0~dfsg+~2.10-1","1:16.23.0~dfsg+~cs6.10.20220309-1","1:16.23.0~dfsg+~cs6.10.20220309-2","1:16.23.0~dfsg+~cs6.10.40431411-1"],"bundled":20},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"pjproject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0.0.ast20130823-1","2.1.0.0.ast20130823-1+deb8u1build0.16.04.1","2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pjproject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6~dfsg-2","2.7~dfsg-1","2.7.1~dfsg-1","2.7.1~dfsg-1build1","2.7.2~dfsg-1","2.7.2~dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1"}]}],"versions":["20190215.1.f152c98~ds1-1","20190215.1.f152c98~ds1-1build1","20190215.1.f152c98~ds1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20180228.1.503da2b~ds1-1ubuntu0.1~esm1"}]}],"versions":["20170803.2.5fcfe3f~dfsg1-1","20171024.1.eadbdeb~ds1-1","20171129.2.cf5bbff~ds1-1","20171129.2.cf5bbff~ds1-2","20180119.1.9e06f94~ds1-1","20180119.1.9e06f94~ds1-3","20180222.1.7bffde2~ds2-2","20180228.1.503da2b~ds1-1","20180228.1.503da2b~ds1-1build1"],"bundled":20},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1"}]}],"versions":["20190215.1.f152c98~ds1-1","20190215.1.f152c98~ds1-1build1","20190215.1.f152c98~ds1-1build2"],"bundled":20}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"pjsip","product":"pjproject"},{"vendor":"teluu","product":"pjsip"}],"references":[{"url":"https://github.com/pjsip/pjproject/security/advisories/GHSA-m66q-q64c-hv36","tags":["x_transferred","Patch","Third Party Advisory","advisory","report"]},{"url":"https://github.com/pjsip/pjproject/commit/22af44e68a0c7d190ac1e25075e1382f77e9397a","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://security.gentoo.org/glsa/202210-37","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://www.debian.org/security/2022/dsa-5285","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-21722","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21722.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21722","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-21722","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-21722","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6422-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-37706","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43299","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43300","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43301","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43302","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43303","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43845","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-21723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23547","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23608","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24763","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24793","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-31031","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-39244","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27585","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-21722","title":"Potential out-of-bound read during RTP/RTCP parsing in PJSIP","description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.","status":"published","published":"2022-01-27T00:00:00Z","modified":"2025-11-04T16:09:29.836Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:28.707644Z"}],"euvd":[{"id":"EUVD-2022-26904","description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.","status":"published","published":"2022-01-27T00:00:00Z","modified":"2025-11-04T16:09:29Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:29.391161Z"}],"nvd":[{"id":"CVE-2022-21722","description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.","status":"published","published":"2022-01-27T00:15:07.653Z","modified":"2026-06-17T04:26:51.43Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:11.52734Z"}],"osv":[{"id":"ALPINE-CVE-2022-21722","description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.","status":"published","published":"2022-01-27T00:15:07.653Z","modified":"2026-11-03T07:18:33.091739421Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"CVE-2022-21722","title":"Potential out-of-bound read during RTP/RTCP parsing in PJSIP","description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.","status":"published","published":"2022-01-27T00:00:00Z","modified":"2026-10-28T10:25:38.326426637Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-21722","description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.","status":"published","published":"2022-01-27T00:15:07.653Z","modified":"2026-11-03T08:02:53.390278064Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"UBUNTU-CVE-2022-21722","description":"PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.","status":"published","published":"2022-01-27T00:15:00Z","modified":"2026-04-22T13:17:18.815809Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"DLA-2962-1","title":"pjproject - security update","status":"published","published":"2022-03-28T00:00:00Z","modified":"2026-03-09T01:22:05.666031Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-3194-1","title":"asterisk - security update","status":"published","published":"2022-11-17T00:00:00Z","modified":"2026-03-09T01:21:37.915359Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3549-1","title":"ring - security update","status":"published","published":"2023-08-29T00:00:00Z","modified":"2026-03-09T01:19:27.113198Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3887-1","title":"ring - security update","status":"published","published":"2024-09-14T00:00:00Z","modified":"2026-03-09T01:22:59.027543Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5285-1","title":"asterisk - security update","status":"published","published":"2022-11-17T00:00:00Z","modified":"2026-03-09T02:08:39.330243Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"USN-6422-1","title":"ring vulnerabilities","description":"\nIt was discovered that Ring incorrectly handled certain inputs. If a user or\nan automated system were tricked into opening a specially crafted input file,\na remote attacker could possibly use this issue to execute arbitrary code.\n(CVE-2021-37706)\n\nIt was discovered that Ring incorrectly handled certain inputs. If a user or\nan automated system were tricked into opening a specially crafted input file,\na remote attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. \n(CVE-2021-43299, CVE-2021-43300, CVE-2021-43301, CVE-2021-43302, \nCVE-2021-43303, CVE-2021-43804, CVE-2021-43845, CVE-2022-21723, \nCVE-2022-23537, CVE-2022-23547, CVE-2022-23608, CVE-2022-24754,\nCVE-2022-24763, CVE-2022-24764, CVE-2022-24793, CVE-2022-31031,\nCVE-2022-39244)\n\nIt was discovered that Ring incorrectly handled certain inputs. If a user or\nan automated system were tricked into opening a specially crafted input file,\na remote attacker could possibly use this issue to cause a denial of service.\nThis issue only affected Ubuntu 20.04 LTS. (CVE-2022-21722)\n\nIt was discovered that Ring incorrectly handled certain inputs. If a user or\nan automated system were tricked into opening a specially crafted input file,\na remote attacker could possibly use this issue to cause a denial of service.\n(CVE-2023-27585)\n","status":"published","published":"2023-10-09T15:09:52Z","modified":"2026-04-27T17:02:16.871002419Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}