OpenSIPS has vulnerability in the ds_is_in_list() function
CVE-2023-28099
5.9MEDIUM
What is CVE-2023-28099?
The vulnerability occurs in the OpenSIPS SIP server, where the function ds_is_in_list() is susceptible to input validation errors. When an invalid IP address string is provided (such as NULL), the function attempts to retrieve and print data from a random memory address. This behavior can result in unexpected application crashes, putting affected servers at risk. To mitigate this vulnerability, users should upgrade to OpenSIPS versions 3.1.9 or 3.2.6 and ensure that valid IPv4 or IPv6 address strings are passed as parameters.
Affected Version(s)
opensips < 3.1.9 < 3.1.9
opensips >= 3.2.0, < 3.2.6 < 3.2.0, 3.2.6