CVE-2022-39269: 
NixOS vulnerability analysis and mitigation

PJSIP, a free and open source multimedia communication library written in C language, was found to contain a critical security vulnerability (CVE-2022-39269) discovered and disclosed on October 6, 2022. The vulnerability affects PJSIP versions from 2.11 up to 2.12.1, with the fix being available in version 2.13 and later (GitHub Advisory).

When processing certain packets, PJSIP may incorrectly switch from using SRTP (Secure Real-time Transport Protocol) media transport to using basic RTP upon SRTP restart, causing the media to be sent insecurely. The vulnerability has been classified as Critical severity, affecting the security of media communications (GitHub Advisory).

The vulnerability impacts all PJSIP users that use SRTP for secure media transport. When exploited, it can result in a downgrade of the media transport from the secure version (SRTP) to the non-secure one (RTP), potentially exposing the media content to unauthorized access (GitHub Advisory).

A patch has been released to address this vulnerability and is available as commit d2acb9a in the master branch. Users are advised to upgrade to PJSIP version 2.13 or later to mitigate this security issue. Various distributions have also released security updates, including Debian and Gentoo, to address this vulnerability (GitHub Advisory, Gentoo Security).