Bug#1031792: sofia-sip: CVE-2022-47516

[Salvatore Bonaccorso]

Source: sofia-sip
Version: 1.12.11+20110422.1+1e14eea~dfsg-4
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for sofia-sip.

CVE-2022-47516[0]:
| An issue was discovered in the libsofia-sip fork in drachtio-server
| before 0.8.20. It allows remote attackers to cause a denial of service
| (daemon crash) via a crafted UDP message that leads to a failure of
| the libsofia-sip-ua/tport/tport.c self assertion.

This was orriginally reported at [1] in the sofia-sip fork as used in
drachtio-server, but was fixed as well in sofia-sip itself at [2].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-47516
    https://www.cve.org/CVERecord?id=CVE-2022-47516
[1] https://github.com/drachtio/drachtio-server/issues/244
[2] https://github.com/freeswitch/sofia-sip/commit/cadf505d88e2971d24b6a4379ddbb1398d8ec443

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore