CVE-2022-39269

What it actually does

The flaw causes PJSIP to incorrectly downgrade from SRTP media transport to plaintext RTP upon SRTP restart triggered by certain packets, exposing media streams.

Why it matters to the business

Encrypted voice and video sessions can be intercepted or altered in transit, resulting in loss of confidentiality for communications in any systems relying on SRTP with this library.

How an attack unfolds

An attacker sends crafted packets that induce an SRTP restart condition, forcing the library to switch transports and transmit media without encryption that can then be captured on the network.

How to fix it

Upgrade pjsip/pjproject to commit 43c745789d291496fe1c3ed8a2c0dd6305260b32 (version 2.13) or ghantoos/lshell to commit a686f71732a3d0f16df52ef46ab8a49ee0083c68. No workarounds exist.

How to confirm the fix worked

Confirm the installed commit or version matches the fixed references and verify through testing that SRTP sessions maintain encryption across restart conditions.

Typical attack path

1. Identify targets using PJSIP with SRTP enabled
2. Transmit specially formed packets to trigger SRTP restart
3. Observe downgrade to RTP transport
4. Capture plaintext media streams for eavesdropping or tampering

How to detect it

Review application and media transport logs for unexpected switches from SRTP to RTP during active sessions; correlate with network captures showing unencrypted media.

What your security team should do

• Apply the listed commits or version upgrades immediately on all affected PJSIP deployments
• Audit applications for SRTP usage and enforce transport verification
• Monitor network traffic for unexpected plaintext RTP flows from SRTP endpoints