PT-2022-20448 · Sofia-Sip+5 · Sofia-Sip+5

Cossack9989 · Published 2022-05-31 · Updated 2025-08-12 · CVE-2022-31001

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Sofia-SIP versions prior to 1.13.8

Description Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. An attacker can send a message with malicious sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by #define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0), which will make n bigger and trigger out-of-bound access when IS NON WS(s[n]).

Recommendations For versions prior to 1.13.8, update to version 1.13.8 to resolve the issue. As a temporary workaround, consider restricting the handling of sdp messages from untrusted sources until the patch is applied.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2022-2574

ALT-PU-2022-2598

ALT-PU-2023-5729

BDU:2025-09864

CVE-2022-31001

DLA-3091-1

DSA-5410-1

GHSA-79JQ-HH82-CV9G

MGASA-2022-0343

USN-5932-1

Affected Products

Alt Linux

Freeswitch

Linuxmint

Red Os

Sofia-Sip

Ubuntu

References · 36

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31001.json · Exploit
• 🔥 https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-79jq-hh82-cv9g · Exploit
• https://github.com/freeswitch/sofia-sip/commit/a99804b336d0e16d26ab7119d56184d2d7110a36 · Patch
• https://osv.dev/vulnerability/DLA-3091-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31003 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-31001 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09864 · Security Note
• https://ubuntu.com/security/notices/USN-5932-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-31001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31001 · Security Note
• https://advisories.mageia.org/MGASA-2022-0343.html · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0343 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5932-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-31001 · Security Note
• https://osv.dev/vulnerability/DSA-5410-1 · Vendor Advisory