CVE-2023-38703
Description
PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2023-38703 NameCVE-2023-38703 DescriptionPJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may…
CVE-2023-38703
| Name | CVE-2023-38703 |
| Description | PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-3696-1, DSA-5596-1 |
| Debian Bugs | 1059303, 1059307 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| asterisk (PTS) | bullseye | 1:16.28.0~dfsg-0+deb11u4 | fixed |
| bullseye (security) | 1:16.28.0~dfsg-0+deb11u9 | fixed | |
| sid | 1:22.9.0+dfsg+~cs6.16.60671434-1 | fixed | |
| ring (PTS) | bullseye | 20210112.2.b757bac~ds1-1 | vulnerable |
| bullseye (security) | 20210112.2.b757bac~ds1-1+deb11u1 | vulnerable | |
| bookworm, bookworm (security) | 20230206.0~ds2-1.1+deb12u1 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| asterisk | source | buster | 1:16.28.0~dfsg-0+deb10u4 | DLA-3696-1 | ||
| asterisk | source | bullseye | 1:16.28.0~dfsg-0+deb11u4 | DSA-5596-1 | ||
| asterisk | source | (unstable) | 1:20.8.1~dfsg+~cs6.14.40431414-1 | 1059303 | ||
| pjproject | source | (unstable) | (unfixed) | |||
| ring | source | (unstable) | (unfixed) | unimportant | 1059307 |
Notes
https://github.com/pjsip/pjproject/security/advisories/GHSA-f76w-fh7c-pc66
https://github.com/pjsip/pjproject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d (2.14)
According to https://bugs.debian.org/1059307#12 Jami's use of pjsip is not affected
by this issue.
Apply commands
https://github.com/pjsip/pjproject/security/advisories/GHSA-f76w-fh7c-pc66https://github.com/pjsip/pjproject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d (2.14)According to https://bugs.debian.org/1059307#12 Jami's use of pjsip is not affectedby this issue.OS impact
Debian Mixed 3 releases
| Version | Status | Fixed in |
|---|---|---|
| sid | Fixed | 1:20.8.1~dfsg+~cs6.14.40431414-1 |
| bullseye | Fixed | 1:16.28.0~dfsg-0+deb11u4 |
| bookworm | Affected | — |
References
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.