CVE catalog

CVE-2022-21723

ring: CVE-2022-21723

Severity: Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Published: Jan 1, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 4.36% · Oct 25, 2026

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	ring	bookworm	`20230206.0~ds2-1.1+deb12u1`	fixed
Debian	ring	bookworm-security	`20230206.0~ds2-1.1+deb12u1`	fixed
Ubuntu	pjproject	pro	`2.6~dfsg-2`	vulnerable
Ubuntu	pjproject	pro	`2.7~dfsg-1`	vulnerable
Ubuntu	pjproject	pro	`2.7.1~dfsg-1`	vulnerable
Ubuntu	pjproject	pro	`2.7.1~dfsg-1build1`	vulnerable
Ubuntu	pjproject	pro	`2.7.2~dfsg-1`	vulnerable
Ubuntu	pjproject	pro	`2.7.2~dfsg-1ubuntu0.1~esm1`	vulnerable
Ubuntu	ring	pro	`20170803.2.5fcfe3f~dfsg1-1`	vulnerable
Ubuntu	ring	pro	`20171024.1.eadbdeb~ds1-1`	vulnerable
Ubuntu	ring	pro	`20171129.2.cf5bbff~ds1-1`	vulnerable
Ubuntu	ring	pro	`20171129.2.cf5bbff~ds1-2`	vulnerable
Ubuntu	ring	pro	`20180119.1.9e06f94~ds1-1`	vulnerable
Ubuntu	ring	pro	`20180119.1.9e06f94~ds1-3`	vulnerable
Ubuntu	ring	pro	`20180222.1.7bffde2~ds2-2`	vulnerable
Ubuntu	ring	pro	`20180228.1.503da2b~ds1-1`	vulnerable
Ubuntu	ring	pro	`20180228.1.503da2b~ds1-1build1`	vulnerable
Ubuntu	ring	pro	`20180228.1.503da2b~ds1-1ubuntu0.1~esm1`	fixed
Ubuntu	ring	20.04	`20190215.1.f152c98~ds1-1`	vulnerable
Ubuntu	ring	20.04	`20190215.1.f152c98~ds1-1build1`	vulnerable
Ubuntu	ring	20.04	`20190215.1.f152c98~ds1-1build2`	vulnerable
Ubuntu	ring	20.04	`20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	ring	source	bookworm	`20230206.0~ds1-1`	not yet assigned	Not reported	[1014998]
Ubuntu	ring	deb	pro	`20180228.1.503da2b~ds1-1ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2022-21723	Not reported
Ubuntu	ring	deb	20.04	`20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1`	Not reported	UBUNTU-CVE-2022-21723	Not reported

[Debian bug #1014998]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[jami]Fixed
Source package: [ring]
Details (4)
- 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
- 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
- 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
- 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
[jami-daemon]Fixed
Source package: [ring]
Details (4)
- 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
- 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
- 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
- 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm

Observed: Oct 23, 2026, 6:24:09 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]