[OpenSIPS-Devel] [OpenSIPS/opensips] 50dcd4: xcap: reject overlong SIP URI normalization input

[Răzvan Crainea]

  Branch: refs/heads/3.6
  Home:   https://github.com/OpenSIPS/opensips
  Commit: 50dcd41b0030c259ce450e76afc8349fc2e43e02
      https://github.com/OpenSIPS/opensips/commit/50dcd41b0030c259ce450e76afc8349fc2e43e02
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M modules/xcap/uri.c

  Log Message:
  -----------
  xcap: reject overlong SIP URI normalization input

Reject invalid or oversized XCAP-provided SIP URIs before unescaping.

Security advisory: GHSA-prfg-gmxf-8v59

Thanks to zx (Jace) @manus-use on GitHub for the report.

(cherry picked from commit c06d9812e8954b541e180cad13f9844604401a15)


  Commit: 67254fe7ccbdbb94eff308721bc229e3a1d2ad6d
      https://github.com/OpenSIPS/opensips/commit/67254fe7ccbdbb94eff308721bc229e3a1d2ad6d
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M modules/enum/enum.c

  Log Message:
  -----------
  enum: reject overlong ISN R-URI users

Reject R-URI user values that cannot fit isn_query()'s buffer.

Security advisory: GHSA-x5hj-r293-vpw4

Thanks to zx (Jace) @manus-use on GitHub for the report.

(cherry picked from commit abd0bff062f5a19465bb52d400c3743be9fc6411)


  Commit: b75daf24e419a6ed430cd7e58e95b18449366d6e
      https://github.com/OpenSIPS/opensips/commit/b75daf24e419a6ed430cd7e58e95b18449366d6e
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M modules/mediaproxy/mediaproxy.c

  Log Message:
  -----------
  mediaproxy: bound SDP connection line insertion

Avoiding unsafe strncat() appends and check whether buffer fits.

Security advisory: GHSA-ggff-j9pg-p572

Thanks to zx (Jace) @manus-use on GitHub for the report.

(cherry picked from commit 0893129568e27d306163f8318617a14f61aeef8b)


  Commit: cb67c69b2c1654d0bfe4c46e13981df408064411
      https://github.com/OpenSIPS/opensips/commit/cb67c69b2c1654d0bfe4c46e13981df408064411
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M modules/pua/hash.c
    M modules/pua/hash.h
    M modules/pua/send_publish.c

  Log Message:
  -----------
  pua: reject overlong publish ETags

Reject too long SIP-ETag values before storing them from PUBLISH replies

Security advisory: GHSA-5w5j-xrr5-wr49

Thanks to zx (Jace) @manus-use on GitHub for the report.

(cherry picked from commit e12c990d2587e92814fafecb53dc54d7865ef8c5)


Compare: https://github.com/OpenSIPS/opensips/compare/8e29c3a09b84...cb67c69b2c16

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications