PT-2022-28068 · Unknown · Drachtio-Server

Asarubboo · Published 2022-12-18 · Updated 2022-12-22 · CVE-2022-47515

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions drachtio-server versions prior to 0.8.20

Description An issue in drachtio-server allows remote attackers to cause a denial of service, resulting in a daemon crash. This is achieved by sending a long message in a TCP request, which leads to a std::length error.

Recommendations For versions prior to 0.8.20, update to version 0.8.20 or later to resolve the issue. As a temporary workaround, consider restricting the length of messages in TCP requests to prevent the daemon crash.

Exploit

Fix

Weakness Enumeration

CWE-170

Related Identifiers

CVE-2022-47515

Affected Products

Drachtio-Server

References · 6

• 🔥 https://github.com/drachtio/drachtio-server/issues/245 · Exploit
• https://github.com/drachtio/drachtio-server/commit/4cf9fe2c420b86c16442215d449d40be777c1911 · Patch
• https://osv.dev/vulnerability/CVE-2022-47515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47515 · Security Note
• https://t.me/cibsecurity/54810 · Telegram Post
• https://t.me/cvenotify/40107 · Telegram Post