Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-28097
HistoryMar 15, 2023 - 12:00 a.m.

CVE-2023-28097

2023-03-1500:00:00
ubuntu.com
ubuntu.com
13
opensips
vulnerability
segmentation fault
sip server
content-length
workaround
fix

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

40.3%

OpenSIPS is a Session Initiation Protocol (SIP) server implementation.
Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a
large Content-Length value and a specially crafted Request-URI causes a
segmentation fault in OpenSIPS. This issue occurs when a large amount of
shared memory using the -m flag was allocated to OpenSIPS, such as 10 GB
of RAM. On the test system, this issue occurred when shared memory was set
to 2362 or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The
only workaround is to guarantee that the Content-Length value of input
messages is never larger than 2147483647.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchopensips< anyUNKNOWN

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

40.3%

Related for UB:CVE-2023-28097