PT-2023-21559 · Opensips · Opensis

Cossack9989 · Published 2023-03-15 · Updated 2023-03-21 · CVE-2023-28099

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.1.9 and 3.2.6

Description OpenSIPS is a Session Initiation Protocol (SIP) server implementation. If the ds is in list() function is used with an invalid IP address string, OpenSIPS will attempt to print a string from a random address, which could lead to a crash. All users of ds is in list() without the $si variable as the 1st parameter could be affected by this issue to a larger, lesser, or no extent at all, depending on if the data passed to the function is a valid IPv4 or IPv6 address string or not.

Recommendations For versions prior to 3.1.9, update to version 3.1.9 or later. For versions prior to 3.2.6, update to version 3.2.6 or later. As a temporary workaround, consider avoiding the use of the ds is in list() function with invalid IP address strings until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-28099

GHSA-PFM5-6VHV-3FF3

Affected Products

Opensis

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28099.json · Exploit
• https://github.com/OpenSIPS/opensips/commit/e2f13d374 · Patch
• https://cve.org/CVERecord?id=CVE-2023-28099 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28099 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28099 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28099 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28099 · Security Note
• https://github.com/OpenSIPS/opensips/security/advisories/GHSA-pfm5-6vhv-3ff3 · Note
• https://github.com/OpenSIPS/opensips/issues/2780 · Note
• https://t.me/cvenotify/46282 · Telegram Post
• https://t.me/cvenotify/46305 · Telegram Post