OpenSIPS has vulnerability in the Content-Length Parser
CVE-2023-28097
7.5HIGH
What is CVE-2023-28097?
The OpenSIPS SIP server implementation is vulnerable to a buffer overflow caused by malformed SIP messages with excessively large Content-Length values. When a SIP message contains a Request-URI formatted in a specific way, and the Content-Length exceeds the limits set, it can lead to a segmentation fault, particularly when a large allocation of shared memory is set (e.g., 10 GB of RAM). This vulnerability affects versions of OpenSIPS prior to 3.1.9 and 3.2.6, with a potential workaround being to restrict the Content-Length of incoming messages to a maximum of 2147483647.
Affected Version(s)
opensips < 3.1.9 < 3.1.9
opensips >= 3.2.0, < 3.2.6 < 3.2.0, 3.2.6