Critical · published October 6, 2022
🚨 A simple packet mishap could flip your secure communications into the danger zone! 🔥 Think of it like a fire alarm accidentally switching to a loudspeaker blaring that the building is on fire—but it’s just a drill! In this case, PJSIP mismanages SRTP and RTP, letting sensitive data slip through like smoke through an open window. An attacker could intercept unencrypted media streams when SRTP unexpectedly downgrades to basic RTP, exposing potentially private conversations and sensitive information. This could lead to disastrous privacy breaches, as anyone with network access could eavesdrop on your multimedia communications.
Think of it like a fire alarm accidentally switching to a loudspeaker blaring that the building is on fire—but it’s just a drill! In this case, PJSIP mismanages SRTP and RTP, letting sensitive data slip through like smoke through an open window. CVE-2022-39269 affects PJSIP when handling certain packets, causing it to incorrectly switch from SRTP to RTP, which transmits data without encryption. This flaw impacts all users relying on SRTP for secure media transport, leaving them exposed to interception.
An attacker could intercept unencrypted media streams when SRTP unexpectedly downgrades to basic RTP, exposing potentially private conversations and sensitive information. This could lead to disastrous privacy breaches, as anyone with network access could eavesdrop on your multimedia communications. To fix this vulnerability, upgrade PJSIP to version 2.13 or apply the patch available as commit d2acb9a in the master branch. If you’re using this library, don’t delay—secure your connections to prevent unauthorized access! You've got this! By patching or upgrading, you're stepping up to protect your communications. 🛡️