Skip to content
OpenAdvisories
High · 8.1 CVE-2022-23608 EUVD-2022-28577

Use after free in PJSIP

Published Feb 22, 2022 · Updated Nov 4, 2025 · Assigned by GitHub_M

Description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions up to and including 2.11.1 when in a dialog set (or forking) scenario, a hash key shared by multiple UAC dialogs can potentially be prematurely freed when one of the dialogs is destroyed . The issue may cause a dialog set to be registered in the hash table multiple times (with different hash keys) leading to undefined behavior such as dialog list collision which eventually leading to endless loop. A patch is available in commit db3235953baa56d2fb0e276ca510fefca751643f which will be included in the next release. There are no known workarounds for this issue.

Affected products

VendorProductAffectedFixed
pjsip pjproject <= 2.11.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 asterisk 1:18.10.1~dfsg+~cs6.10.40431411-1 —
Debian 12 ring 20230206.0~ds1-1 —
Debian 11 asterisk 1:16.28.0~dfsg-0+deb11u1 DSA-5285-1
Debian 11 ring 20210112.2.b757bac~ds1-1+deb11u1 DLA-3887-1
Debian 10 asterisk 1:16.28.0~dfsg-0+deb10u1 DLA-3194-1
Debian 10 ring 20190215.1.f152c98~ds1-1+deb10u2 DLA-3549-1
Debian 9 pjproject 2.5.5~dfsg-6+deb9u3 DLA-2962-1
ReleasePackageFixed inAdvisory
Ubuntu 26.10 asterisk No fix yet —
Ubuntu 26.04 LTS asterisk No fix yet —
Ubuntu 25.10 asterisk No fix yet —
Ubuntu 24.04 LTS asterisk No fix yet —
Ubuntu 22.04 LTS asterisk No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS asterisk No fix yet —
Ubuntu 20.04 LTS ring 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 USN-6422-1
Ubuntu 18.04 LTS asterisk No fix yet —
Ubuntu Pro 18.04 LTS pjproject No fix yet —
Ubuntu Pro 18.04 LTS ring 20180228.1.503da2b~ds1-1ubuntu0.1~esm1 USN-6422-1
Ubuntu Pro 16.04 LTS asterisk +1 No fix yet —
ReleasePackageFixed inAdvisory
Alpine v3.24 pjproject 2.12-r0 —
Alpine v3.23 pjproject 2.12-r0 —
Alpine v3.22 pjproject 2.12-r0 —
Alpine v3.21 pjproject 2.12-r0 —
Alpine v3.20 pjproject 2.12-r0 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 pjproject 2.12-r0 —
Alpine v3.18 pjproject 2.12-r0 —
Alpine v3.17 pjproject 2.12-r0 —
Alpine v3.16 pjproject 2.12-r0 —

Advisories 7

References