OpenSIPS has vulnerability in the parse_to_param() function
CVE-2023-27599
7.5HIGH
What is CVE-2023-27599?
OpenSIPS is a commonly used Session Initiation Protocol (SIP) server vulnerable to a Denial of Service attack due to improper handling of malformed 'To' headers in SIP messages. Specifically, prior to versions 3.1.7 and 3.2.4, the function 'append_hf' could lead to a crash of the OpenSIPS server when it encounters such malformed headers. This results in a significant disruption of service, making it imperative for users to update to secure versions to prevent exploitation and ensure operational continuity.
Affected Version(s)
opensips < 3.1.7 < 3.1.7
opensips >= 3.2.0, < 3.2.4 < 3.2.0, 3.2.4