Vulnerability Details : CVE-2023-28097
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `2147483647`.
Vulnerability category: OverflowMemory Corruption
Products affected by CVE-2023-28097
- cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:*
- cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-28097
0.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 51 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-28097
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST | |
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
GitHub, Inc. |
CWE ids for CVE-2023-28097
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by: security-advisories@github.com (Primary)
References for CVE-2023-28097
-
https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq
Vulnerability in the Content-Length Parser · Advisory · OpenSIPS/opensips · GitHubThird Party Advisory
-
https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
Vendor Advisory
-
https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5
core: Fix Content-Length parsing · OpenSIPS/opensips@7cab422 · GitHubPatch;Third Party Advisory
Jump to