// For flags

CVE-2023-38703

PJSIP has use-after-free vulnerability in SRTP media transport

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch.

PJSIP es una librería de comunicación multimedia gratuita y de código abierto escrita en C con API de alto nivel en los lenguajes C, C++, Java, C# y Python. SRTP es un transporte de medios de nivel superior que se apila sobre un transporte de medios de nivel inferior, como UDP e ICE. Actualmente, un transporte de nivel superior no está sincronizado con su transporte de nivel inferior, lo que puede introducir un problema de use-after-free. Esta vulnerabilidad afecta a las aplicaciones que tienen capacidad SRTP (`PJMEDIA_HAS_SRTP` está configurado) y utilizan transporte de medios subyacente distinto de UDP. El impacto de esta vulnerabilidad puede variar desde la terminación inesperada de la aplicación hasta el secuestro de flujo de control/corrupción de memoria. El parche está disponible como commit en la rama master.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-07-24 CVE Reserved
  • 2023-10-06 CVE Published
  • 2024-09-19 CVE Updated
  • 2024-11-07 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-416: Use After Free
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Teluu
Search vendor "Teluu"
Pjsip
Search vendor "Teluu" for product "Pjsip"
<= 2.13.1
Search vendor "Teluu" for product "Pjsip" and version " <= 2.13.1"
-
Affected