CVE-2022-47517: High severity drachtio vulnerability
Published Dec 18, 2022
·Updated
An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a urlcanonize2 heap-based buffer over-read because of an off-by-one error.
Affected Software
1 affected component
drachtio drachtio-server<0.8.19
Remediation
Event History
Dec 18, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2022-47517?
CVE-2022-47517 is classified as a denial of service vulnerability that can lead to a daemon crash.
2
How do I fix CVE-2022-47517?
The vulnerability CVE-2022-47517 can be mitigated by upgrading drachtio-server to version 0.8.19 or later.
3
Who is affected by CVE-2022-47517?
CVE-2022-47517 affects users of drachtio-server versions prior to 0.8.19.
4
What type of vulnerability is CVE-2022-47517?
CVE-2022-47517 is a heap-based buffer over-read vulnerability caused by an off-by-one error.
5
Can CVE-2022-47517 be exploited remotely?
Yes, CVE-2022-47517 can be exploited by remote attackers through crafted UDP messages.