PatchTheCVEdrachtio-server vulnerabilities and fixes
Recent CVEs affecting drachtio-server, with upgrade or downgrade steps. 6 tracked.
Also searched as: drachtio server.
drachtio-server has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 4. Most recent: 2022-12-18. Highest priority: CVE-2022-45474 (score 60/100).
- CVE-2022-47517 HIGH 7.5 UPGRADE An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19
- CVE-2022-47516 HIGH 7.5 UPGRADE An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20
- CVE-2022-47515 HIGH 7.5 UPGRADE An issue was discovered in drachtio-server before 0.8.20
- CVE-2022-45909 CRITICAL 9.1 UPGRADE drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request.
- CVE-2022-45474 CRITICAL 9.8 DOWNGRADE drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request.
- CVE-2022-45473 MEDIUM 5.5 DOWNGRADE In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666.
FAQ
How do I fix drachtio-server vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is drachtio-server being exploited right now?
None of the tracked drachtio-server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which drachtio-server CVE should I patch first?
CVE-2022-45474 currently ranks highest (60/100): drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request..