Strix
26.1K

CVE-2022-23608

CRITICALCVSS 9.8/10EPSS 3.99%

Last modified

CVE-2022-23608 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . EPSS estimates a 3.99% chance of exploitation in the next 30 days.

Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
3.99%

89.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersionsUpdate
TeluuPjsip<= 2.11.1—
AsteriskCertified Asterisk< 16.8.0—
AsteriskCertified Asterisk16.8.0Cert1
SangomaAsterisk>= 16.0.0, < 16.24.1—
SangomaAsterisk>= 18.0.0, < 18.10.1—
SangomaAsterisk>= 19.0.0, < 19.2.1—
DebianDebian Linux9.0—
DebianDebian Linux10.0—

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-23608?
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue.
How severe is CVE-2022-23608?
CVE-2022-23608 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 3.99% probability of exploitation in the next 30 days.
How do I fix CVE-2022-23608?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-23608?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST