| Name | CVE-2022-47516 |
| Description | An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.c self assertion. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-3334-1, DSA-5410-1 |
| Debian Bugs | 1031792 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| sofia-sip (PTS) | buster | 1.12.11+20110422.1-2.1 | vulnerable |
| buster (security) | 1.12.11+20110422.1-2.1+deb10u4 | fixed |
| bullseye (security), bullseye | 1.12.11+20110422.1-2.1+deb11u2 | fixed |
| trixie, bookworm | 1.12.11+20110422.1+1e14eea~dfsg-6 | fixed |
| sid | 1.12.11+20110422.1+1e14eea~dfsg-6.1 | fixed |
The information below is based on the following data on fixed versions.
Notes
Report in fork: https://github.com/drachtio/drachtio-server/issues/244
https://github.com/freeswitch/sofia-sip/commit/cadf505d88e2971d24b6a4379ddbb1398d8ec443 (v1.13.14)