PatchTheCVEdrachtio vulnerabilities
Recent CVEs affecting drachtio products. 6 tracked.
drachtio has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 4. Most recent: 2022-12-18. Highest priority: CVE-2022-45474 (score 60/100).
- CVE-2022-47517 HIGH 7.5 UPGRADE An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19
- CVE-2022-47516 HIGH 7.5 UPGRADE An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20
- CVE-2022-47515 HIGH 7.5 UPGRADE An issue was discovered in drachtio-server before 0.8.20
- CVE-2022-45909 CRITICAL 9.1 UPGRADE drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request.
- CVE-2022-45474 CRITICAL 9.8 DOWNGRADE drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request.
- CVE-2022-45473 MEDIUM 5.5 DOWNGRADE In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666.
FAQ
How do I fix drachtio vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is drachtio being exploited right now?
None of the tracked drachtio CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which drachtio CVE should I patch first?
CVE-2022-45474 currently ranks highest (60/100): drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request..