CVE-2023-28099: OpenSIPS has vulnerability in the ds_is_in_list() function
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if dsisinlist() is used with an invalid IP address string (NULL is illegal input), OpenSIPS will attempt to print a string from a random address (stack garbage), which could lead to a crash. All users of dsisinlist() without the $si variable as 1st parameter could be affected by this vulnerability to a larger, lesser or no extent at all, depending if the data passed to the function is a valid IPv4 or IPv6 address string or not. Fixes will are available starting with the 3.1.9 and 3.2.6 minor releases. There are no known workarounds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-28099?
CVE-2023-28099 has been assigned a severity level that indicates a potential risk due to improper handling of invalid IP addresses.
How do I fix CVE-2023-28099?
To fix CVE-2023-28099, upgrade OpenSIPS to version 3.1.9 or 3.2.6 or later.
What versions of OpenSIPS are affected by CVE-2023-28099?
CVE-2023-28099 affects OpenSIPS versions prior to 3.1.9 and versions between 3.2.0 and 3.2.6.
What type of vulnerability is CVE-2023-28099?
CVE-2023-28099 is related to improper input validation which can lead to unspecified consequences.
Is it safe to use OpenSIPS versions below 3.1.9 or between 3.2.0 and 3.2.6 after CVE-2023-28099?
Using OpenSIPS versions below 3.1.9 or between 3.2.0 and 3.2.6 after CVE-2023-28099 poses a security risk due to the identified vulnerability.