CVE catalog
CVE-2022-24786
ring: CVE-2022-24786
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.05% · Oct 25, 2026
PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feedback RPSI (Reference Picture Selection Indication) packet, but any app that directly uses pjmedia_rtcp_fb_parse_rpsi() will be affected. A patch is available in the `master` branch of the `pjsip/pjproject` GitHub repository. There are currently no known workarounds.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | ring | bookworm | 20230206.0~ds2-1.1+deb12u1 | fixed |
| Debian | ring | bookworm-security | 20230206.0~ds2-1.1+deb12u1 | fixed |
| Ubuntu | pjproject | pro | 2.6~dfsg-2 | vulnerable |
| Ubuntu | pjproject | pro | 2.7~dfsg-1 | vulnerable |
| Ubuntu | pjproject | pro | 2.7.1~dfsg-1 | vulnerable |
| Ubuntu | pjproject | pro | 2.7.1~dfsg-1build1 | vulnerable |
| Ubuntu | pjproject | pro | 2.7.2~dfsg-1 | vulnerable |
| Ubuntu | pjproject | pro | 2.7.2~dfsg-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | ring | pro | 20170803.2.5fcfe3f~dfsg1-1 | vulnerable |
| Ubuntu | ring | pro | 20171024.1.eadbdeb~ds1-1 | vulnerable |
| Ubuntu | ring | pro | 20171129.2.cf5bbff~ds1-1 | vulnerable |
| Ubuntu | ring | pro | 20171129.2.cf5bbff~ds1-2 | vulnerable |
| Ubuntu | ring | pro | 20180119.1.9e06f94~ds1-1 | vulnerable |
| Ubuntu | ring | pro | 20180119.1.9e06f94~ds1-3 | vulnerable |
| Ubuntu | ring | pro | 20180222.1.7bffde2~ds2-2 | vulnerable |
| Ubuntu | ring | pro | 20180228.1.503da2b~ds1-1 | vulnerable |
| Ubuntu | ring | pro | 20180228.1.503da2b~ds1-1build1 | vulnerable |
| Ubuntu | ring | pro | 20180228.1.503da2b~ds1-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | ring | 20.04 | 20190215.1.f152c98~ds1-1 | vulnerable |
| Ubuntu | ring | 20.04 | 20190215.1.f152c98~ds1-1build1 | vulnerable |
| Ubuntu | ring | 20.04 | 20190215.1.f152c98~ds1-1build2 | vulnerable |
| Ubuntu | ring | 20.04 | 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | ring | source | bookworm | 20230206.0~ds1-1 | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [jami]Fixed
Source package: [ring]
Details (4)
20230206.0~ds2-1.1+deb12u1· amd64 · bookwormFixed · Fixed:
20230206.0~ds1-1dsa · ring · debian · bookworm
20230206.0~ds2-1.1+deb12u1· arm64 · bookwormFixed · Fixed:
20230206.0~ds1-1dsa · ring · debian · bookworm
20230206.0~ds2-1.1+deb12u1· amd64 · bookworm-securityFixed · Fixed:
20230206.0~ds1-1dsa · ring · debian · bookworm
20230206.0~ds2-1.1+deb12u1· arm64 · bookworm-securityFixed · Fixed:
20230206.0~ds1-1dsa · ring · debian · bookworm
- [jami-daemon]Fixed
Source package: [ring]
Details (4)
20230206.0~ds2-1.1+deb12u1· amd64 · bookwormFixed · Fixed:
20230206.0~ds1-1dsa · ring · debian · bookworm
20230206.0~ds2-1.1+deb12u1· arm64 · bookwormFixed · Fixed:
20230206.0~ds1-1dsa · ring · debian · bookworm
20230206.0~ds2-1.1+deb12u1· amd64 · bookworm-securityFixed · Fixed:
20230206.0~ds1-1dsa · ring · debian · bookworm
20230206.0~ds2-1.1+deb12u1· arm64 · bookworm-securityFixed · Fixed:
20230206.0~ds1-1dsa · ring · debian · bookworm
Observed: