Detections
Analytics
Alpine: multiple sofia-sip packages: security update to 1.13.8-r0
critical Tenable Cloud Security Plugin ID 424478
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8,
an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may
be caused by `#define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0)`, which will make `n` bigger and
trigger out-of-bound access when `IS_NON_WS(s[n])`. Version 1.13.8 contains a patch for this issue.
(CVE-2022-31001)
- Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8,
an attacker can send a message with evil sdp to FreeSWITCH, which may cause a crash. This type of crash
may be caused by a URL ending with `%`. Version 1.13.8 contains a patch for this issue. (CVE-2022-31002)
- Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8,
when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause
an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or
more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.
(CVE-2022-31003)
See Also
https://security.alpinelinux.org/vuln/CVE-2022-31001
Plugin Details
Severity: Critical
ID: 424478
Version: Revision 1.10
Type: Local
Published: 4/4/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2022-31003
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 5/31/2022