CVE-2023-28099 OpenSIPS has vulnerability in the ds_is_in_list() function

Medium 5.9 Published 15 Mar 2023 Updated 25 Feb 2025

OpenSIPS crashes when ds_is_in_list() receives invalid IP input, causing denial of service for SIP server users.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-28099?

CVE-2023-28099 is a medium-severity vulnerability in opensips, published on 15 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if `ds_is_in_list()` is used with an invalid IP address string (`NULL` is illegal input), OpenSIPS will attempt to print a string from a random address (stack garbage), which could lead to a crash. All users of `ds_is_in_list()` without the `$si` variable as 1st parameter could be affected by this vulnerability to a larger, lesser or no extent at all, depending if the data passed to the function is a valid IPv4 or IPv6 address string or not. Fixes will are available starting with the 3.1.9 and 3.2.6 minor releases. There are no known workarounds.

Weakness: CWE-20

Which versions are affected by CVE-2023-28099?

It affects 1 product.

Products include Opensips Opensips.

How do I fix CVE-2023-28099?

No fix has been published for CVE-2023-28099 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-28099 being exploited?

There is no known exploitation of CVE-2023-28099 in the wild and no public exploit code.

Sources

Also known as GHSA-pfm5-6vhv-3ff3, UBUNTU-CVE-2023-28099.