CVE-2023-27585
PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects appl...
Original description
The description as published by the source.
PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record parse_query(), while the issue in CVE-2022-24793 is in parse_rr(). A patch is available as commit d1c5e4d in the master branch. A workaround is to disable DNS resolution in PJSIP config (by setting nameserver_count to zero) or use an external resolver implementation instead.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2023-27585 pjproject Fixed in: 2.13.1-r0
- Debian DEBIAN-CVE-2023-27585 asterisk Fixed in: 1:16.28.0~dfsg-0+deb11u3
References
- advisory github.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory debian.org
- patch github.com
- web lists.debian.org
- web pjsip.org
- web lists.debian.org
- web lists.debian.org