CVE-2022-31001

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by `#define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0)`, which will make `n` bigger and trigger out-of-bound access when `IS_NON_WS(s[n])`. Version 1.13.8 contains a patch for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
freeswitch	sofia-sip	< 1.13.8

References

https://github.com/freeswitch/sofia-sip/commit/a99804b336d0e16d26ab7119d56184d2d7110a36Patch, Third Party Advisory
https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-79jq-hh82-cv9gExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00001.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202210-18Third Party Advisory
https://www.debian.org/security/2023/dsa-5410Third Party Advisory
https://github.com/freeswitch/sofia-sip/commit/a99804b336d0e16d26ab7119d56184d2d7110a36Patch, Third Party Advisory
https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-79jq-hh82-cv9gExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00001.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202210-18Third Party Advisory
https://www.debian.org/security/2023/dsa-5410Third Party Advisory

Timeline

Published: May 31, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-310027.5Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message wi CVE-2022-310039.8Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp m CVE-2022-310047.5CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for product CVE-2022-310057.5Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer ov CVE-2022-310067.5indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions o CVE-2022-310077.2eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an authenticated user with CVE-2022-310087.5RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation CVE-2022-310096.5wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication partners may render the iOS CVE-2022-31015.5A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently rest CVE-2022-310117.8TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditio CVE-2022-310127.3Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows CVE-2022-310139.8Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validatin