CVE-2022-45909: Critical severity drachtio drachtio-server vulnerability
Published Nov 26, 2022
·Updated
drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request.
Affected Software
1 affected component
drachtio drachtio-server<0.8.19
Remediation
Event History
Nov 26, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·03:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by sending a crafted INVITE request with a long Request-URI to an affected drachtio-server instance. User interaction is not required.
2
Which versions are affected and what fixes the issue?
drachtio-server versions before 0.8.19 are affected. Updating to version 0.8.19 or later addresses the vulnerability.
3
What is the likely impact of successful exploitation?
The vulnerability can expose sensitive information and cause a denial of service through a heap-based buffer over-read. The supplied CVSS vector rates confidentiality and availability impact as high.