Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2022-24763: PJSIP library may freeze applications that parse XML
CVE-2022-24763 · published 4 years ago
Summary
Versions of the PJSIP communication library up to 2.12 can get stuck in an endless loop when processing certain XML data, which can cause the program using it to stop responding. This affects any software that relies on PJSIP for XML handling, including pjproject, Ring, and Asterisk on Debian systems. Upgrade to the latest version of PJSIP as soon as possible; there is no practical workaround.
What to do
- Update canonical ring to version 20180228.1.503da2b~ds1-1ubuntu0.1~esm1.
- Update canonical ring to version 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1.
- Update debian asterisk to version 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1.
- Update debian ring to version 20230206.0~ds1-1.
- Update teluu pjsip to version 2.13 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | pjproject | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | pjproject | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | ring |
< 20180228.1.503da2b~ds1-1ubuntu0.1~esm1 Fix: upgrade to 20180228.1.503da2b~ds1-1ubuntu0.1~esm1
|
| Ubuntu:20.04:LTS | canonical | ring |
< 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 Fix: upgrade to 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1
|
| – | teluu | pjsip |
>= 2.5, < 2.13 cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
9.0 10.0 11.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Debian:14 | debian | asterisk |
< 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1 Fix: upgrade to 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1
|
| Debian:12 | debian | ring |
< 20230206.0~ds1-1 Fix: upgrade to 20230206.0~ds1-1
|
Original advisory text
Infinite Loop in PJSIP
PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-service vulnerability that affects PJSIP users that consume PJSIP's XML parsing in their apps. Users are advised to update. There are no known workarounds.
References
- https://ubuntu.com/security/CVE-2022-24763 Third Party Advisory
- https://ubuntu.com/security/notices/USN-6422-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-24763 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24763... Vendor Advisory
- https://github.com/pjsip/pjproject/security/advisories/GHSA-5x45-qp78-g4p4 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-24763 Vendor Advisory
- https://security.gentoo.org/glsa/202210-37 Vendor Advisory
- https://www.debian.org/security/2022/dsa-5285 Vendor Advisory
- https://github.com/pjsip/pjproject/commit/856f87c2e97a27b256482dbe0d748b1194355a... Patch
- https://lists.debian.org/debian-lts-announce/2022/05/msg00047.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-24763 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published30 Mar 2022
Updated4 Nov 2026
First seen25 Mar 2026
Sources
UBUNTU-CVE-2022-24763 · OSV
CVE-2022-24763 · OSV
GHSA-5x45-qp78-g4p4 · GHSA
CVE-2022-24763 · NVD
DEBIAN-CVE-2022-24763 · OSV
Track software like this
Free during beta