← Zuruck zu CVEs

CVE-2023-28095

HIGH

7.5

Beschreibung

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in `msg_translator.c:2628` which might lead to a server crash. This issue was found while fuzzing the function `build_res_buf_from_sip_req` but could not be reproduced against a running instance of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was found to make use of this vulnerable code. Even in the case of exploitation through unknown vectors, it is highly unlikely that this issue would lead to anything other than Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.

CVE Details

CVSS v3.1 Bewertung7.5

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht3/15/2023

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

opensips:opensips

Schwachen (CWE)

CWE-20

Referenzen

https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c(security-advisories@github.com)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h(security-advisories@github.com)

https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf(security-advisories@github.com)

https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h(af854a3a-2127-422b-91ae-364da2661108)

https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.