CVE-2023-27596: OpenSIPS has vulnerability in the codec_delete_XX() functions
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, OpenSIPS crashes when a malformed SDP body is sent multiple times to an OpenSIPS configuration that makes use of the streamprocess function. This issue was discovered during coverage guided fuzzing of the function codecdeleteexceptre. By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function codecdeleteexceptre. This issue has been fixed in version 3.1.8 and 3.2.5.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-27596?
CVE-2023-27596 is considered a critical vulnerability as it leads to crashes in OpenSIPS when a malformed SDP body is processed.
How do I fix CVE-2023-27596?
To fix CVE-2023-27596, upgrade OpenSIPS to version 3.1.8 or later, or to version 3.2.5 or later.
What versions of OpenSIPS are affected by CVE-2023-27596?
OpenSIPS versions prior to 3.1.8 and those between 3.2.0 and 3.2.5 are affected by CVE-2023-27596.
What impact does CVE-2023-27596 have on OpenSIPS?
CVE-2023-27596 can cause OpenSIPS to crash when a specific malformed SDP body is sent multiple times.
Is there a workaround for CVE-2023-27596?
While the only effective resolution is to upgrade to a fixed version, temporarily restricting access or filtering out malformed SDP bodies may mitigate immediate risk.