PatchTheCVEresiprocate vulnerabilities and fixes
Recent CVEs affecting resiprocate, with upgrade or downgrade steps. 3 tracked.
resiprocate has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2018-07-16. Highest priority: CVE-2018-12584 (score 74/100).
- CVE-2018-12584 CRITICAL 9.8 UPGRADE MITIGATE The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2
- CVE-2017-9454 HIGH 7.5 UPGRADE Buffer overflow in the ares_parse_a_reply function in the embedded ares library in ReSIProcate before 1.12.0 a
- CVE-2017-11521 HIGH 7.5 DOWNGRADE MITIGATE The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in reSIProcate 1.10.2 allows r
FAQ
How do I fix resiprocate vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is resiprocate being exploited right now?
None of the tracked resiprocate CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which resiprocate CVE should I patch first?
CVE-2018-12584 currently ranks highest (74/100): The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 .