PT-2022-27678 · Unknown · Drachtio-Server

Published 2022-11-26 · Updated 2023-02-01 · CVE-2022-45909

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions drachtio-server versions prior to 0.8.19

Description The issue is a heap-based buffer over-read that occurs when a long Request-URI is sent in an INVITE request. This can be exploited via the Request-URI in an INVITE request.

Recommendations For versions prior to 0.8.19, update to version 0.8.19 or later to resolve the issue. As a temporary workaround, consider restricting the length of the Request-URI in INVITE requests to prevent exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-45909

Affected Products

Drachtio-Server

References · 8

• https://github.com/drachtio/drachtio-server/commit/a63d01854987d9fd846cdc9265af38ee9eb72490 · Patch
• https://github.com/drachtio/drachtio-server/compare/v0.8.18...v0.8.19 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-45909 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45909 · Vendor Advisory
• https://github.com/drachtio/drachtio-server/pull/238 · Note
• https://t.me/cvenotify/38537 · Telegram Post
• https://t.me/cvenotify/38878 · Telegram Post
• https://t.me/cibsecurity/53546 · Telegram Post