OpenSIPS has vulnerability in the Digest Authentication Parser

CVE-2023-28098

What is CVE-2023-28098?

OpenSIPS, a Session Initiation Protocol (SIP) server implementation, exhibits a vulnerability that may result in server crashes or unpredictable behavior. This issue arises from a flaw in the parse_param_name() function, triggered by a specially crafted Authorization header. The problem was uncovered during fuzz testing, which revealed that the underlying cause is linked to the q_memchr() function invocation. Affected configurations may see erratic behavior, especially when utilizing functions like www_authorize(). Versions 3.1.7 and 3.2.4 include necessary patches to mitigate this issue.

References