CVE-2022-23537: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch (2.13.1). The GHSA severity is "critical", unclear what's critical about a buffer overread. Unreleased patch: https://github.com/pjsip/pjproject/commit/d8440f4d711a654b511f50f79c0445b26f9dd1e1
CVE-2022-23547 (https://github.com/pjsip/pjproject/security/advisories/GHSA-cxwq-5g9x-x7fr https://github.com/pjsip/pjproject/commit/bc4812d31a67d5e2f973fbfaf950d6118226cf36 PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a certain STUN message. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as commit in the master branch.
I guess that depends on what you use that data for ... asterisk uses STUN potentially, simple workaround (which in general I recommend, but not always possible) is to not use STUN. Technically you need STUN for ICE which you need for WebRTC, but it's possible to configure your way around that. Both advisories reference a release 2.13.1 which I can't seem to locate at all.
