PT-2022-28069 · Unknown+3 · Drachtio-Server+4

Asarubboo · Published 2022-12-18 · Updated 2025-08-12 · CVE-2022-47516

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions drachtio-server versions prior to 0.8.20

Description An issue in the libsofia-sip fork allows remote attackers to cause a denial of service via a crafted UDP message, leading to a daemon crash due to a failure in the libsofia-sip-ua/tport/tport.c self assertion. The config sortlist function is also missing checks for input string validity, potentially allowing an arbitrary length stack overflow.

Recommendations For versions prior to 0.8.20, update to version 0.8.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable libsofia-sip-ua/tport/tport.c module to minimize the risk of exploitation. Avoid using crafted UDP messages that could lead to a denial of service until the issue is resolved.

Exploit

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BDU:2025-09869

CVE-2022-47516

DLA-3334-1

DSA-5410-1

MGASA-2023-0072

USN-5932-1

Affected Products

Linuxmint

Red Os

Ubuntu

Drachtio-Server

Libsofia-Sip

References · 30

• 🔥 https://github.com/drachtio/drachtio-server/issues/244 · Exploit
• https://github.com/davehorton/sofia-sip/commit/13b2a135287caa2d67ac6cd5155626821e25b377 · Patch
• https://advisories.mageia.org/MGASA-2023-0072.html · Security Note
• https://ubuntu.com/security/CVE-2022-31003 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-47516 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5932-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5932-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09869 · Security Note
• https://osv.dev/vulnerability/MGASA-2023-0072 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3334-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5410-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31002 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-47516 · Security Note
• https://debian.org/lts/security/2023/dla-3334 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-22741 · Vendor Advisory