Bug 2067032 (CVE-2022-24764)

Summary: CVE-2022-24764 fedora: PJSIP contains a stack buffer overflow vulnerability that affects PJSUA2 users
Product: [Other] Security Response Reporter: Rohit Keshri <rkeshri>
Component: vulnerabilityAssignee: Nobody <nobody>
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: carl, jsmith.fedora
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-10-05 17:24:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 2242356, 2242357    
Bug Blocks:    

Description Rohit Keshri 2022-03-23 05:57:06 UTC
PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulnerability that affects PJSUA2 users or users that call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`. Applications that do not use PJSUA2 and do not directly call `pjmedia_sdp_print()` or `pjmedia_sdp_media_print()` should not be affected. A patch is available on the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.


Comment 2 Carl George 🤠 2023-10-05 17:24:22 UTC
Created pjproject tracking bugs for this issue:

Affects: epel-all [bug 2242356]
Affects: fedora-all [bug 2242357]

Comment 3 Carl George 🤠 2023-10-05 17:24:44 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.