CVE-2023-28098

Katalog CVE

CVSS 7.5 · High EPSS 0,91%

Kerentanan Improper Input Validation pada opensips. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenSIPS to crash or behave in an unexpected way due to a bug in the function `parse_param_name()` . This issue was discovered while performing coverage guided fuzzing of the function parse_msg. The AddressSanitizer identified that the issue occurred in the function `q_memchr()` which is being called by the function `parse_param_name()`. This issue may cause erratic program behaviour or a server crash. It affects configurations containing functions that make use of the affected code, such as the function `www_authorize()` . Versions 3.1.7 and 3.2.4 contain a fix.

Rincian

Terbit di NVD

15 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenSIPS/opensips/commit/dd9141b6f67d7df4072f3430f628d4b73df5e102 patch · advisory pihak ketiga
• https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h advisory pihak ketiga
• https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf advisory pihak ketiga