OpenSIPS has vulnerability in the codec_delete_XX() functions
CVE-2023-27600
7.5HIGH
What is CVE-2023-27600?
OpenSIPS, a Session Initiation Protocol (SIP) server implementation, is susceptible to a vulnerability that causes server crashes when a malformed Session Description Protocol (SDP) body is received. This issue stems from the delete_sdp_line function in the sipmsgops module, which fails to handle SDP lines not terminated by a line feed ( ). Attackers can exploit this flaw, particularly in configurations using codec_delete_except_re and similar functions, resulting in an abort in the server's lumps processing, ultimately leading to a Denial of Service. Versions 3.1.7 and 3.2.4 have patched this vulnerability.
Affected Version(s)
opensips < 3.1.7 < 3.1.7
opensips >= 3.2.0, < 3.2.4 < 3.2.0, 3.2.4