CVE-2023-28097 - Vulnerability Details - OpenCVE

ReportizFlow

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `2147483647`.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Opensips	Opensips

Configuration 1 [-]

OR	cpe:2.3:a:opensips:opensips::::::::
	cpe:2.3:a:opensips:opensips::::::::

No data.

References

Link	Providers
https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5
https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq
https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-03-15T22:03:41.362Z

Updated: 2024-08-02T12:30:24.168Z

Reserved: 2023-03-10T18:34:29.225Z

Link: CVE-2023-28097

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-03-15T23:15:09.627

Modified: 2024-11-21T07:54:23.787

Link: CVE-2023-28097

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-28097", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-03-10T18:34:29.225Z", "datePublished": "2023-03-15T22:03:41.362Z", "dateUpdated": "2024-08-02T12:30:24.168Z"}, "containers": {"cna": {"title": "OpenSIPS has vulnerability in the Content-Length Parser", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "lang": "en", "description": "CWE-190: Integer Overflow or Wraparound", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq"}, {"name": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5"}, {"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf", "tags": ["x_refsource_MISC"], "url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"}], "affected": [{"vendor": "OpenSIPS", "product": "opensips", "versions": [{"version": "< 3.1.9", "status": "affected"}, {"version": ">= 3.2.0, < 3.2.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-03-15T22:03:41.362Z"}, "descriptions": [{"lang": "en", "value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `2147483647`."}], "source": {"advisory": "GHSA-c6j5-f4h4-2xrq", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T12:30:24.168Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq"}, {"name": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5"}, {"name": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:*", "matchCriteriaId": "F318FB66-A6E9-4A16-996B-DD76A8C64A6E", "versionEndExcluding": "3.1.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:*", "matchCriteriaId": "3C466525-94B6-4196-9CEA-CD72452FE22D", "versionEndExcluding": "3.2.6", "versionStartIncluding": "3.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large _Content-Length_ value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to `2362` or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than `2147483647`."}], "id": "CVE-2023-28097", "lastModified": "2024-11-21T07:54:23.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-03-15T23:15:09.627", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/OpenSIPS/opensips/commit/7cab422e2fc648f910abba34f3f0dbb3ae171ff5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-c6j5-f4h4-2xrq"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "[email protected]", "type": "Secondary"}]}