Pexip security bulletins

The following security bulletins are published by Pexip for issues affecting our own products — Pexip Infinity, the Pexip Pexip apps, the VMR self-service portal, and Enhanced Room Management. There are currently no security bulletins for any other Pexip products, including the Reverse Proxy and TURN Server, Pexip Justice, or AIMS.

For information about external issues arising in third-party software and operating systems that may impact these Pexip products, see https://www.pexip.com/trust-center. Where relevant, updates will be incorporated into each Pexip product, so we recommend that you frequently check for and always run the latest versions of each product. If you have deployed Pexip's VMR self-service portal, Reverse Proxy and TURN Server, Pexip Justice or AIMS products, you should also ensure that the appliance's operating system is regularly patched against the latest security bugs.

More information specific for each of the vulnerabilities can be found via the NIST National Vulnerability Database: http://nvd.nist.gov/.

Pexip Infinity

This list covers issues addressed in Pexip Infinity v35.0 and later. For issues addressed in v34.x or earlier, see our documentation for previous releases.

Each bulletin addresses a number of vulnerabilities in the operating system software used by Pexip Infinity. The bulletins include an assessment of the issues, the impact to the Pexip Infinity platform, and resolution details.

In the table below, "Severity" reflects the severity of the issue as calculated from the CVSS Base Score. "Risk" reflects the risk associated with each vulnerability in the context of the Pexip Infinity product environment.

Reference Description Severity Risk Updated Impacted versions Addressed in version
CVE-2025-32095

Insufficient input validation in the signalling implementation(s) allows a remote attacker to trigger a software abort resulting in a denial of service.

CVSS3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Discussion: A crafted signalling message allows a remote attacker to trigger a software abort.

Mitigation: None

Resolution: Upgrade to Pexip Infinity v37.0

 High High March 2025 All before 37.0 37.0
CVE-2025-30080

Insufficient input validation in the signalling implementation(s) allows a malicious attacker to trigger a software abort resulting in a temporary denial of service.

CVSS3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Mitigation: None

Resolution: Upgrade to Pexip Infinity v37.0

 High High March 2025 29 - 36.2 37.0
CVE-2024-12084

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

CVSS 3.1 base score: 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Discussion: Exploitation of this vulnerability requires access to the operating system on an Infinity node as the rsync daemon is not exposed to the network outside the Infinity deployment. Therefore, the risk to Infinity is reduced from Critical to High.

Mitigation: Ensure only trusted users have operating system access to the Infinity deployment.

Resolution: Upgrade to Pexip Infinity v37.0

 Critical High March 2025 All before 37.0 37.0
Multiple Resolved minor issues: CVE-2023-3019, CVE-2023-3301, CVE-2023-52596, CVE-2023-52619, CVE-2023-52621, CVE-2023-52622, CVE-2023-52889, CVE-2023-6683, CVE-2024-2004, CVE-2024-2398, CVE-2024-24789, CVE-2024-2511, CVE-2024-26327, CVE-2024-26328, CVE-2024-26581, CVE-2024-26601, CVE-2024-26602, CVE-2024-26603, CVE-2024-26621, CVE-2024-26622, CVE-2024-26626, CVE-2024-26627, CVE-2024-26640, CVE-2024-26641, CVE-2024-26642, CVE-2024-26643, CVE-2024-26665, CVE-2024-26671, CVE-2024-26673, CVE-2024-26676, CVE-2024-26679, CVE-2024-26687, CVE-2024-26688, CVE-2024-26698, CVE-2024-26704, CVE-2024-26718, CVE-2024-26720, CVE-2024-26731, CVE-2024-26733, CVE-2024-26735, CVE-2024-26737, CVE-2024-26739, CVE-2024-26740, CVE-2024-26759, CVE-2024-26760, CVE-2024-26761, CVE-2024-26763, CVE-2024-26764, CVE-2024-26769, CVE-2024-26772, CVE-2024-26773, CVE-2024-26774, CVE-2024-26775, CVE-2024-26782, CVE-2024-26783, CVE-2024-26798, CVE-2024-26803, CVE-2024-26804, CVE-2024-26805, CVE-2024-26809, CVE-2024-26810, CVE-2024-26812, CVE-2024-26815, CVE-2024-26816, CVE-2024-26835, CVE-2024-26840, CVE-2024-26844, CVE-2024-26845, CVE-2024-26851, CVE-2024-26852, CVE-2024-26857, CVE-2024-26862, CVE-2024-26865, CVE-2024-26878, CVE-2024-26880, CVE-2024-26882, CVE-2024-26883, CVE-2024-26884, CVE-2024-26885, CVE-2024-26891, CVE-2024-26894, CVE-2024-26898, CVE-2024-26900, CVE-2024-26901, CVE-2024-26906, CVE-2024-26907, CVE-2024-26920, CVE-2024-26921, CVE-2024-26923, CVE-2024-26924, CVE-2024-26925, CVE-2024-26935, CVE-2024-26953, CVE-2024-26960, CVE-2024-26976, CVE-2024-26983, CVE-2024-26987, CVE-2024-26988, CVE-2024-26992, CVE-2024-26993, CVE-2024-27013, CVE-2024-27014, CVE-2024-27015, CVE-2024-27016, CVE-2024-27019, CVE-2024-27020, CVE-2024-27022, CVE-2024-27024, CVE-2024-27047, CVE-2024-27065, CVE-2024-27389, CVE-2024-27393, CVE-2024-27403, CVE-2024-27415, CVE-2024-27437, CVE-2024-31076, CVE-2024-3447, CVE-2024-35255, CVE-2024-35803, CVE-2024-35860, CVE-2024-35875, CVE-2024-35904, CVE-2024-35929, CVE-2024-35939, CVE-2024-35945, CVE-2024-35947, CVE-2024-35961, CVE-2024-35974, CVE-2024-35995, CVE-2024-36000, CVE-2024-36017, CVE-2024-36028, CVE-2024-36244, CVE-2024-36270, CVE-2024-36286, CVE-2024-36489, CVE-2024-36881, CVE-2024-36882, CVE-2024-36883, CVE-2024-36889, CVE-2024-36890, CVE-2024-36891, CVE-2024-36901, CVE-2024-36902, CVE-2024-36903, CVE-2024-36904, CVE-2024-36905, CVE-2024-36908, CVE-2024-36909, CVE-2024-36910, CVE-2024-36911, CVE-2024-36912, CVE-2024-36913, CVE-2024-36916, CVE-2024-36917, CVE-2024-36918, CVE-2024-36927, CVE-2024-36929, CVE-2024-36933, CVE-2024-36938, CVE-2024-36971, CVE-2024-36974, CVE-2024-36978, CVE-2024-36979, CVE-2024-37356, CVE-2024-37370, CVE-2024-37371, CVE-2024-37568, CVE-2024-38538, CVE-2024-38555, CVE-2024-38556, CVE-2024-38557, CVE-2024-38564, CVE-2024-38576, CVE-2024-38577, CVE-2024-38580, CVE-2024-38586, CVE-2024-38588, CVE-2024-38596, CVE-2024-38598, CVE-2024-38601, CVE-2024-38612, CVE-2024-38615, CVE-2024-38627, CVE-2024-39276, CVE-2024-39298, CVE-2024-39329, CVE-2024-39330, CVE-2024-39371, CVE-2024-39474, CVE-2024-39476, CVE-2024-39482, CVE-2024-39487, CVE-2024-39489, CVE-2024-39490, CVE-2024-39494, CVE-2024-39499, CVE-2024-39500, CVE-2024-39501, CVE-2024-39508, CVE-2024-39509, CVE-2024-39614, CVE-2024-40900, CVE-2024-40905, CVE-2024-40906, CVE-2024-40908, CVE-2024-40914, CVE-2024-40919, CVE-2024-40931, CVE-2024-40935, CVE-2024-40937, CVE-2024-40938, CVE-2024-40945, CVE-2024-40947, CVE-2024-40953, CVE-2024-40954, CVE-2024-40957, CVE-2024-40958, CVE-2024-40959, CVE-2024-40960, CVE-2024-40961, CVE-2024-40966, CVE-2024-40972, CVE-2024-40980, CVE-2024-40982, CVE-2024-40984, CVE-2024-40990, CVE-2024-40995, CVE-2024-40997, CVE-2024-40998, CVE-2024-41000, CVE-2024-41001, CVE-2024-41005, CVE-2024-41007, CVE-2024-41009, CVE-2024-41012, CVE-2024-41020, CVE-2024-41027, CVE-2024-41031, CVE-2024-41040, CVE-2024-41041, CVE-2024-41042, CVE-2024-41048, CVE-2024-41049, CVE-2024-41050, CVE-2024-41057, CVE-2024-41058, CVE-2024-41073, CVE-2024-41077, CVE-2024-41079, CVE-2024-41081, CVE-2024-41090, CVE-2024-41091, CVE-2024-41096, CVE-2024-41098, CVE-2024-41989, CVE-2024-41991, CVE-2024-42005, CVE-2024-42063, CVE-2024-42067, CVE-2024-42068, CVE-2024-42080, CVE-2024-42098, CVE-2024-42106, CVE-2024-42131, CVE-2024-42135, CVE-2024-42136, CVE-2024-42145, CVE-2024-42152, CVE-2024-42154, CVE-2024-42159, CVE-2024-42229, CVE-2024-42232, CVE-2024-42239, CVE-2024-42241, CVE-2024-42243, CVE-2024-42245, CVE-2024-42247, CVE-2024-42265, CVE-2024-42268, CVE-2024-42269, CVE-2024-42270, CVE-2024-42276, CVE-2024-42281, CVE-2024-42283, CVE-2024-42285, CVE-2024-42292, CVE-2024-42302, CVE-2024-42304, CVE-2024-42305, CVE-2024-42306, CVE-2024-42312, CVE-2024-42315, CVE-2024-42316, CVE-2024-42318, CVE-2024-42321, CVE-2024-42322, CVE-2024-4317, CVE-2024-43817, CVE-2024-43828, CVE-2024-43834, CVE-2024-43837, CVE-2024-43853, CVE-2024-43854, CVE-2024-43856, CVE-2024-43866, CVE-2024-43869, CVE-2024-43870, CVE-2024-43871, CVE-2024-43873, CVE-2024-43882, CVE-2024-43889, CVE-2024-43890, CVE-2024-43892, CVE-2024-43893, CVE-2024-43914, CVE-2024-44934, CVE-2024-44940, CVE-2024-44944, CVE-2024-44946, CVE-2024-44947, CVE-2024-45490, CVE-2024-4603, CVE-2024-4741, CVE-202024-5535, CVE-2024-6119, CVE-2024-8008     November 2024   36.0
CVE-2024-37917

Insufficient input validation in the signalling implementation(s) allows a remote attacker to trigger a software abort resulting in a denial of service.

CVSS3.1 base score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Discussion: A crafted signalling message allows a remote attacker to trigger a software abort.

Mitigation: None

Resolution: Upgrade to Pexip Infinity v35.0 or later

 High High July 2024 All before 35.0 35.0
Multiple Resolved minor issues: CVE-2021-22959, CVE-2021-22960, CVE-2021-44532, CVE-2021-44533, CVE-2022-0597, CVE-2022-32213, CVE-2022-32214, CVE-2022-32215, CVE-2022-3523, CVE-2022-35256, CVE-2022-3567, CVE-2023-1637, CVE-2023-30588, CVE-2023-3161, CVE-2023-39326, CVE-2023-4459, CVE-2023-48795, CVE-2023-48795, CVE-2023-52435, CVE-2023-52458, CVE-2024-0450, CVE-2024-27086, CVE-2024-28102, CVE-2024-28219, CVE-2024-29992, CVE-2024-35255, CVE-2023-50387, CVE-2023-50868, CVE-2024-34397, CVE-2024-2961, CVE-2022-4864, CVE-2024-32487, CVE-2024-24806, CVE-2024-2511, CVE-2024-4603, CVE-2024-4741, CVE-2023-28405, CVE-2023-6597, CVE-2024-28085, CVE-2022-3566, CVE-2023-3640, CVE-2023-4387, CVE-2023-52452, CVE-2023-52476, CVE-2023-52492, CVE-2023-52498, CVE-2024-26589     July 2024   35.0

Pexip apps

Each bulletin addresses a number of vulnerabilities in the software used by the Pexip apps. The bulletins include an assessment of the issues, the impact on the Pexip app, and resolution details.

Bulletin Description Risk Updated Impacted versions Addressed in version
CVE-2024-38392

Insufficient authenticity checks in loading resources allow an attacker to cause the application to run untrusted code.

CVSS3.1 base score: 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.13.0 and Connect mobile app v1.13.0

Credit: This issue was responsibly disclosed by Mand Consulting Group

 Medium July 2024   1.13.0
CVE-2022-2478

Use after free in PDF in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

 High March 2023 Unknown 1.12
CVE-2022-2295

Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

 High March 2023

Unknown

 1.12
CVE-2022-2294

Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

 High March 2023 Unknown 1.12
CVE-2022-2162

Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 103.0.5060.53 allowed a remote attacker to bypass file system access via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

High

 March 2023 Unknown 1.12
CVE-2022-2011

Use after free in ANGLE in Google Chrome prior to 102.0.5005.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 base score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: None

Resolution: Upgrade to Connect desktop app v1.12

 High March 2023 Unknown 1.12
 

Resolved minor issue: CVE-2022-1867

 

   March 2023   1.12

VMR self-service portal

Each bulletin addresses a number of vulnerabilities in the software used by the VMR self-service portal. The bulletins include an assessment of the issues, the impact on the VMR portal, and resolution details.

Bulletin Description Risk Updated Impacted versions Addressed in version
CVE-2023-40236

The Pexip VMR self-service portal before v3 uses the same SSH host keys across different customers' installations, which allows man-in-the-middle attackers to spoof fake instances by leveraging these keys.

CVSS 3.1 base score: 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

Mitigation: Manually remove and regenerate the SSH host keys on each VMR Portal instance.

Resolution: Upgrade to VMR portal v3.

 High October 2023 All prior to version 3 3

Enhanced Room Management

Each bulletin addresses a number of vulnerabilities in the software used by ERM. The bulletins include an assessment of the issues, the impact on the VMR portal, and resolution details.

Bulletin Description Risk Updated Impacted versions Addressed in version
CVE-2024-6387

A race condition was found in OpenSSH's server. If a client does not authenticate within 120 seconds then sshd's SIGALRM handler is called asynchronously and calls various functions that are not async-signal-safe. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code with root privileges.

CVSS3.1 base score: 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Mitigation: The mitigation for older versions (prior to v2.0.1) is to disable the Proxy service in the ERM Installer and redeploy, however we recommend upgrading to v2.0.1 as soon as practicable.

Resolution: Install v2.0.1 security upgrade 2024-07-09.

 High July 2024 All prior to version 2.0.1 2.0.1 security upgrade 2024-07-09