Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b707c, a stack buffer overflow exists in the SRTP/SDES media transport when processing a=crypto attributes during SDP offer/answer (sdes_encode_sdp() in transport_srtp_sdes.c). This affects applications with SRTP enabled (use_srtp optional or mandatory, using SDES keying). During media negotiation, the crypto attributes from the remote SDP are collected into a fixed-size array without bounding their number; a remote peer that includes an excessive number of a=crypto attributes in a single media description can write past the end of that array on the stack. This is reachable from an incoming SIP INVITE during offer/answer, before application-level authentication. Impact may range from unexpected application termination to control flow hijack/memory corruption. Applications that do not enable SRTP are not affected. This issue has been patched via commit a1b707c.
Not applicable to Asterisk as built here. This is a stack buffer overflow in sdes_encode_sdp() in transport_srtp_sdes.c, reached when processing a=crypto attributes during SDP offer/answer. The upstream advisory states it affects applications with SRTP enabled using SDES keying, and that applications which do not enable SRTP are not affected. Asterisk disables pjproject's SRTP support in the bundled build. third-party/pjproject/patches/config_site.h sets PJMEDIA_HAS_SRTP to 0, and the bundled copy is configured with --disable-libsrtp and --without-external-srtp. Asterisk provides SRTP through its own res_srtp module instead. Fixed upstream in pjproject commit a1b707c.
Closing as NOTABUG per the analysis above — pjproject's SRTP support is disabled in the bundled build, and Asterisk provides SRTP through its own res_srtp module. As with the other pjproject CVEs in this batch, this is a build-configuration determination. It would need revisiting if the bundled build ever enabled pjproject's SRTP.