CVE-2022-31001

Description

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by `#define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0)`, which will make `n` bigger and trigger out-of-bound access when `IS_NON_WS(s[n])`. Version 1.13.8 contains a patch for this issue.

How to fix CVE-2022-31001

To remediate CVE-2022-31001, upgrade the affected package to a fixed version below.

• —upgrade to 1.13.8-r0 or later
• —upgrade to 1.12.11+20110422.1-2.1+deb11u1 or later
• —upgrade to 1.12.11+20110422.1-2.1+deb10u1 or later
• —upgrade to 1.12.11+20110422.1-2.1+deb11u1 or later

Is CVE-2022-31001 being exploited?

Low — EPSS is 1.0%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 1.13.8-r0
• from 0, < 1.12.11+20110422.1-2.1+deb11u1
• from 0, < 1.12.11+20110422.1-2.1+deb10u1
• from 0, < 1.12.11+20110422.1-2.1+deb11u1

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2022-31001
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-31001