Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip (pjsip pjproject)

CVE-2022-39269

CRITICAL 9.1

En bref

Source: NVD
EPSS: EPSS 0.73 % · centile 54 (2026-11-01)
État: PUBLISHED
Publiée: 2022-10-06 00:00 UTC
Mise à jour: 2025-04-23 16:52 UTC
Attribuée par: GitHub_M
Statut NVD: Modified

Rechercher sur…

Description

PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability impacts all PJSIP users that use SRTP. The patch is available as commit d2acb9a in the master branch of the project and will be included in version 2.13. Users are advised to manually patch or to upgrade. There are no known workarounds for this vulnerability.

Faiblesses (CWE)

CWE-319 — Transmission en clair d'informations sensibles

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	GitHub_M
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2022-41776
GCVE · GCVE-0-2022-39269

Configurations affectées (CPE NVD)

cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:* ≥ 2.11 < 2.13

Produits affectés

Produit	Versions
pjsip · pjproject	affected >= 2.11, < 2.13

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 Media transport downgrade from the secure version (SRTP) to non-secure (RTP) in pjsip (pjsip pjproject)