UBUNTU-CVE-2023-28096

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2023-28096
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-28096.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2023-28096
Upstream
Published
2023-03-15T22:15:00Z
Modified
2025-10-24T05:01:52Z
Severity
  • 4.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function parse_mi_request while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form {"jsonrpc": "2.0","method": "log_le. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time. To abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted interfaces. In cases where the MI is exposed to the internet without authentication, abuse of this issue will lead to memory exhaustion which may affect the underlying system’s availability. No authentication is typically required to reproduce this issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing JSON objects. The issue has been fixed in versions 3.1.8 and 3.2.5.

References

Affected packages

Ubuntu:18.04:LTS / opensips

Package

Name
opensips
Purl
pkg:deb/ubuntu/opensips@2.2.2-3build4?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.2.2-3build2
2.2.2-3build3
2.2.2-3build4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "opensips",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-b2bua-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-berkeley-bin",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-berkeley-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-carrierroute-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-compression-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-console",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-cpl-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-dbhttp-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-dialplan-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-emergency-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-geoip-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-http-modules",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-identity-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-jabber-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-json-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-ldap-modules",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-lua-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-memcached-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-mysql-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-perl-modules",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-postgres-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-presence-modules",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-rabbitmq-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-radius-modules",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-redis-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-regex-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-restclient-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-sctp-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-snmpstats-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-sqlite-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-tls-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-tlsmgm-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-unixodbc-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-wss-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-xmlrpc-module",
            "binary_version": "2.2.2-3build4"
        },
        {
            "binary_name": "opensips-xmpp-module",
            "binary_version": "2.2.2-3build4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-28096.json"