Vulnerability Details : CVE-2022-24792
PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length greater than 31-bit integers. The vulnerability does not affect 64-bit apps and should not affect apps that only plays trusted WAV files. A patch is available on the `master` branch of the `pjsip/project` GitHub repository. As a workaround, apps can reject a WAV file received from an unknown source or validate the file first.
Vulnerability category: Denial of service
Exploit prediction scoring system (EPSS) score for CVE-2022-24792
Probability of exploitation activity in the next 30 days: 0.24%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 62 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2022-24792
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
GitHub, Inc. |
CWE ids for CVE-2022-24792
-
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.Assigned by:
- nvd@nist.gov (Secondary)
- security-advisories@github.com (Primary)
References for CVE-2022-24792
-
https://github.com/pjsip/pjproject/commit/947bc1ee6d05be10204b918df75a503415fd3213
Merge pull request from GHSA-rwgw-vwxg-q799 · pjsip/pjproject@947bc1e · GitHubPatch;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2022/05/msg00047.html
[SECURITY] [DLA 3036-1] pjproject security updateMailing List;Third Party Advisory
-
https://github.com/pjsip/pjproject/security/advisories/GHSA-rwgw-vwxg-q799
Potential infinite loop when parsing WAV format file · Advisory · pjsip/pjproject · GitHubPatch;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
[SECURITY] [DLA 3194-1] asterisk security updateMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/202210-37
PJSIP: Multiple Vulnerabilities (GLSA 202210-37) — Gentoo securityThird Party Advisory
-
https://www.debian.org/security/2022/dsa-5285
Debian -- Security Information -- DSA-5285-1 asteriskMailing List;Third Party Advisory
Products affected by CVE-2022-24792
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
- cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:x86:*