Impact

The vulnerability affects applications that uses PJSIP DNS resolver, e.g: in PJSUA/PJSUA2 configured via pjsua_config.nameserver or UaConfig.nameserver.

It doesn't affect PJSIP users that does not utilises PJSIP DNS resolver, i.e: one of the following:

• not configuring nameserver in PJSUA/PJSUA2 (as described above), so the library will use the OS resolver such as via getaddrinfo(), or
• using an external resolver implementation, i.e: configured using pjsip_resolver_set_ext_resolver().

Also related to GHSA-p6g5-v97c-w5q4.
(The difference is that this issue occurs when parsing RR record parse_rr(), while the issue in GHSA-p6g5-v97c-w5q4 is in parsing the query record parse_query()).

Patches

The patch is available as commit d1c5e4d in the master branch.

Workarounds

A workaround is to disable DNS resolution in PJSIP config (by setting nameserver_count to zero) or use an external resolver implementation instead.

For more information

If you have any questions or comments about this advisory:
Email us at security@pjsip.org