CVE catalog

CVE-2022-31031

ring: CVE-2022-31031

Severity: Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Jun 9, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.04% · Oct 25, 2026

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their applications, either by: setting a STUN server in their account/media config in PJSUA/PJSUA2 level, or directly using `pjlib-util/stun_simple` API. A patch is available in commit 450baca which should be included in the next release. There are no known workarounds for this issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	ring	bookworm	`20230206.0~ds2-1.1+deb12u1`	fixed
Debian	ring	bookworm-security	`20230206.0~ds2-1.1+deb12u1`	fixed
Ubuntu	pjproject	pro	`2.6~dfsg-2`	vulnerable
Ubuntu	pjproject	pro	`2.7~dfsg-1`	vulnerable
Ubuntu	pjproject	pro	`2.7.1~dfsg-1`	vulnerable
Ubuntu	pjproject	pro	`2.7.1~dfsg-1build1`	vulnerable
Ubuntu	pjproject	pro	`2.7.2~dfsg-1`	vulnerable
Ubuntu	pjproject	pro	`2.7.2~dfsg-1ubuntu0.1~esm1`	vulnerable
Ubuntu	ring	pro	`20170803.2.5fcfe3f~dfsg1-1`	vulnerable
Ubuntu	ring	pro	`20171024.1.eadbdeb~ds1-1`	vulnerable
Ubuntu	ring	pro	`20171129.2.cf5bbff~ds1-1`	vulnerable
Ubuntu	ring	pro	`20171129.2.cf5bbff~ds1-2`	vulnerable
Ubuntu	ring	pro	`20180119.1.9e06f94~ds1-1`	vulnerable
Ubuntu	ring	pro	`20180119.1.9e06f94~ds1-3`	vulnerable
Ubuntu	ring	pro	`20180222.1.7bffde2~ds2-2`	vulnerable
Ubuntu	ring	pro	`20180228.1.503da2b~ds1-1`	vulnerable
Ubuntu	ring	pro	`20180228.1.503da2b~ds1-1build1`	vulnerable
Ubuntu	ring	pro	`20180228.1.503da2b~ds1-1ubuntu0.1~esm1`	fixed
Ubuntu	ring	20.04	`20190215.1.f152c98~ds1-1`	vulnerable
Ubuntu	ring	20.04	`20190215.1.f152c98~ds1-1build1`	vulnerable
Ubuntu	ring	20.04	`20190215.1.f152c98~ds1-1build2`	vulnerable
Ubuntu	ring	20.04	`20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	ring	source	bookworm	`20230206.0~ds1-1`	not yet assigned	Not reported	[1017005]
Ubuntu	ring	deb	pro	`20180228.1.503da2b~ds1-1ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2022-31031	Not reported
Ubuntu	ring	deb	20.04	`20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1`	Not reported	UBUNTU-CVE-2022-31031	Not reported

[Debian bug #1017005]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[jami]Fixed
Source package: [ring]
Details (4)
- 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
- 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
- 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
- 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
[jami-daemon]Fixed
Source package: [ring]
Details (4)
- 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
- 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
- 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm
- 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 20230206.0~ds1-1
  dsa · ring · debian · bookworm

Observed: Oct 23, 2026, 6:26:51 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]