CVE-2022-31002 Out-of-bounds Read in Sofia-SIP
An attacker can cause a crash in FreeSWITCH by sending a malicious SIP message with a specific SDP payload, requiring an upgrade to the Sofia-SIP library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31002?
CVE-2022-31002 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 31 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash may be caused by a URL ending with `%`. Version 1.13.8 contains a patch for this issue.
Weakness: CWE-125
Which versions are affected by CVE-2022-31002?
It affects 2 products.
Products include Debian Debian Linux, Signalwire Sofia-Sip.
How do I fix CVE-2022-31002?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-31002 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31002 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2022-31002, DEBIAN-CVE-2022-31002, GHSA-g3x6-p824-x6hm, UBUNTU-CVE-2022-31002.