CVE-2022-24763

What it actually does

Denial of service via malformed XML input to the parser, leading to crash or resource exhaustion in versions 2.12 and prior.

Why it matters to the business

Potential disruption of services relying on PJSIP for multimedia communication, affecting availability for affected products like GitLab and PJProject.

How an attack unfolds

Attacker sends crafted XML payload to an application consuming PJSIP's XML parsing functionality, triggering the vulnerability and causing service outage.

How to fix it

Update to fixed versions such as pjsip/pjproject 43c745789d291496fe1c3ed8a2c0dd6305260b32 or GitLab 14.10.5 where applicable.

How to confirm the fix worked

Verify updated package versions and test XML parsing with known problematic inputs to confirm resolution.

Typical attack path

1. Identify services using vulnerable PJSIP version
2. Craft malicious XML input
3. Transmit payload to the target application
4. Observe service disruption or crash

How to detect it

Monitor application logs for unexpected crashes during XML processing; check for high CPU or memory usage spikes correlated with network traffic.

What your security team should do

• Apply updates to fixed versions immediately
• Review applications using PJSIP for XML parsing usage
• Monitor for service availability issues