CVE-2022-24754

PJSIP is a free and open source multimedia communication library written in C language. In versions prior to and including 2.12 PJSIP there is a stack-buffer overflow vulnerability which only impacts PJSIP users who accept hashed digest credentials (credentials with data_type `PJSIP_CRED_DATA_DIGEST`). This issue has been patched in the master branch of the PJSIP repository and will be included with the next release. Users unable to upgrade need to check that the hashed digest data length must be equal to `PJSIP_MD5STRLEN` before passing to PJSIP.

• CWE-120
• CWE-1284

• https://github.com/pjsip/pjproject/commit/d27f79da11df7bc8bb56c2f291d71e54df8d2c47Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-73f7-48m9-w662Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/03/msg00035.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
• https://security.gentoo.org/glsa/202210-37Third Party Advisory
• https://github.com/pjsip/pjproject/commit/d27f79da11df7bc8bb56c2f291d71e54df8d2c47Patch, Third Party Advisory
• https://github.com/pjsip/pjproject/security/advisories/GHSA-73f7-48m9-w662Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/03/msg00035.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
• https://security.gentoo.org/glsa/202210-37Third Party Advisory

Published

Mar 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24749Sylius is an open source eCommerce platform. In versions pri…6.1
• CVE-2022-2475Haas Controller version 100.20.000.1110 has insufficient gra…8.8
• CVE-2022-24750UltraVNC is a free and open source remote pc access software…7.8
• CVE-2022-24751Zulip is an open source group chat application. Starting wit…7.4
• CVE-2022-24752SyliusGridBundle is a package of generic data grids for Symf…9.8
• CVE-2022-24753Stripe CLI is a command-line tool for the Stripe eCommerce p…7
• CVE-2022-24755Bareos is open source software for backup, archiving, and re…9.8
• CVE-2022-24756Bareos is open source software for backup, archiving, and re…7.5
• CVE-2022-24757The Jupyter Server provides the backend (i.e. the core servi…7.5
• CVE-2022-24758The Jupyter notebook is a web-based notebook environment for…7.5
• CVE-2022-24759`@chainsafe/libp2p-noise` contains TypeScript implementation…7.4
• CVE-2022-2476A null pointer dereference bug was found in wavpack-5.4.0 Th…5.5