CVE-2023-27599highCWE-20

CVE-2023-27599: falha de alta gravidade em opensips

OpenSIPS has vulnerability in the parse_to_param() function

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar opensips

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 1.0%
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, when the function `append_hf` handles a SIP message with a malformed To header, a call to the function `abort()` is performed, resulting in a crash. This is due to the following check in `data_lump.c:399` in the function `anchor_lump`. An attacker abusing this vulnerability will crash OpenSIPS leading to Denial of Service. It affects configurations containing functions that make use of the affected code, such as the function `append_hf`. This issue has been fixed in versions 3.1.7 and 3.2.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
OpenSIPS · opensips
CVEs relacionadas — opensips

No mesmo produto, das mais perigosas para as menos.

CVE-2023-27601HIGHOpenSIPS has vulnerability in the codec_delete_XX() functionsEPSS 1.0%CVE-2023-27600HIGHOpenSIPS has vulnerability in the codec_delete_XX() functionsEPSS 1.0%CVE-2023-27598HIGHOpenSIPS has vulnerability in the parse_via() functionEPSS 1.0%CVE-2023-28097HIGHOpenSIPS has vulnerability in the Content-Length ParserEPSS 1.0%CVE-2023-28095HIGHOpenSIPS has vulnerability in the building the local negative repliesEPSS 1.0%CVE-2023-28099MEDIUMOpenSIPS has vulnerability in the ds_is_in_list() functionEPSS 0.9%