CVE-2023-27596
on github
Published
Severity
CVSS v3:
7.5 HIGH
CVSS v2:
N/A
Description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, OpenSIPS crashes when a malformed SDP body is sent multiple times to an OpenSIPS configuration that makes use of the `stream_process` function. This issue was discovered during coverage guided fuzzing of the function `codec_delete_except_re`. By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. This issue has been fixed in version 3.1.8 and 3.2.5.
References
Configurations
CPE23 | Version Start | Version End | Exact Version |
---|---|---|---|
cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:* | n/a | 3.1.8 | * |
cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:* | 3.2.0 (including) | 3.2.5 | * |