CVE-2022-47516

Name of the Vulnerable Software and Affected Versions drachtio-server versions prior to 0.8.20

Description An issue in the libsofia-sip fork allows remote attackers to cause a denial of service via a crafted UDP message, leading to a daemon crash due to a failure in the libsofia-sip-ua/tport/tport.c self assertion. The config sortlist function is also missing checks for input string validity, potentially allowing an arbitrary length stack overflow.

Recommendations For versions prior to 0.8.20, update to version 0.8.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable libsofia-sip-ua/tport/tport.c module to minimize the risk of exploitation. Avoid using crafted UDP messages that could lead to a denial of service until the issue is resolved.