VYPR
← All advisories
High severity7.5NVD Advisory· Published May 31, 2022· Updated Jun 17, 2026

CVE-2022-31001

CVE-2022-31001

Description

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by #define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0), which will make n bigger and trigger out-of-bound access when IS_NON_WS(s[n]). Version 1.13.8 contains a patch for this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Signalwire/sofia-sip2 versions
    cpe:2.3:a:signalwire:sofia-sip:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:signalwire:sofia-sip:*:*:*:*:*:*:*:*range: <1.13.8
    • (no CPE)range: <1.13.8
  • Debian/linux2 versions
    cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
  • osv-coords
    pkg:rpm/opensuse/sofia-sip&distro=openSUSE%20Tumbleweed
    Range: < 1.13.17+50-1.1
  • freeswitch/sofia-sipv5
    Range: < 1.13.8

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.