OpenSIPS has vulnerability in the codec_delete_XX() functions
CVE-2023-27601
7.5HIGH
What is CVE-2023-27601?
OpenSIPS, a widely used Session Initiation Protocol (SIP) server, is susceptible to crashes triggered by malformed Session Description Protocol (SDP) bodies. Specifically, the vulnerability arises in the delete_sdp_line function located in the sipmsgops module, which mishandles incomplete SDP lines that lack proper termination. Exploiting this flaw allows an attacker to induce a Denial of Service condition, leading to server instability. This issue affects configurations using functions like codec_delete_except_re, which rely on the vulnerable code. Versions 3.1.7 and 3.2.4 have been released to remediate this vulnerability, ensuring robust handling of SDP messages.
Affected Version(s)
opensips < 3.1.7 < 3.1.7
opensips >= 3.2.0, < 3.2.4 < 3.2.0, 3.2.4