CVE catalog

CVE-2022-39244

ring affected and fixed versions

[CVE catalog]

PJSIP is a free and open source multimedia communication library written in C. In versions of PJSIP prior to 2.13 the PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced by a buffer overflow vulnerability. Users connecting to untrusted clients are at risk. This issue has been patched and is available as commit c4d3498 in the master branch and will be included in releases 2.13 and later. Users are advised to upgrade. There are no known workarounds for this issue.

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.50% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debianbookworm-securityring20230206.0~ds2-1.1+deb12u1Fixed[CVE-2022-39244]
Debianbookwormring20230206.0~ds1-1FixedDistribution-reported fixed boundary[CVE-2022-39244]
Debianbookwormring20230206.0~ds2-1.1+deb12u1Fixed[CVE-2022-39244]
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormring20230206.0~ds1-1FixedDistribution-reported fixed boundary[CVE-2022-39244]
Debianbookwormring20230206.0~ds2-1.1+deb12u1Fixed[CVE-2022-39244]
Debianbookworm-securityring20230206.0~ds2-1.1+deb12u1Fixed[CVE-2022-39244]
Original provider fields
{
  "package_releases": [
    {
      "name": "ring",
      "status": "fixed",
      "release": "bookworm",
      "version": "20230206.0~ds2-1.1+deb12u1"
    },
    {
      "name": "ring",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "20230206.0~ds2-1.1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "ring",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "20230206.0~ds1-1"
    }
  ],
  "distribution_packages": []
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [jami]Unknown

    Source package: [ring]

    Details (4)

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm

  • [jami-daemon]Unknown

    Source package: [ring]

    Details (4)

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm

    • 20230206.0~ds2-1.1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm

    • 20230206.0~ds2-1.1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 20230206.0~ds1-1

      dsa · ring · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX]