[OpenSIPS-Devel] [OpenSIPS/opensips] eea545: xcap: reject overlong SIP URI normalization input

[Răzvan Crainea]

  Branch: refs/heads/4.0
  Home:   https://github.com/OpenSIPS/opensips
  Commit: eea545e97df1802918d7eb4c0fabab57fce221e2
      https://github.com/OpenSIPS/opensips/commit/eea545e97df1802918d7eb4c0fabab57fce221e2
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M modules/xcap/uri.c

  Log Message:
  -----------
  xcap: reject overlong SIP URI normalization input

Reject invalid or oversized XCAP-provided SIP URIs before unescaping.

Security advisory: GHSA-prfg-gmxf-8v59

Thanks to zx (Jace) @manus-use on GitHub for the report.

(cherry picked from commit c06d9812e8954b541e180cad13f9844604401a15)


  Commit: d7db34cc380c152a226bcb8e55e12834a632d8ca
      https://github.com/OpenSIPS/opensips/commit/d7db34cc380c152a226bcb8e55e12834a632d8ca
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M modules/enum/enum.c

  Log Message:
  -----------
  enum: reject overlong ISN R-URI users

Reject R-URI user values that cannot fit isn_query()'s buffer.

Security advisory: GHSA-x5hj-r293-vpw4

Thanks to zx (Jace) @manus-use on GitHub for the report.

(cherry picked from commit abd0bff062f5a19465bb52d400c3743be9fc6411)


  Commit: 72e9c4325e9e148dee561acccbdffd0cfb4062bd
      https://github.com/OpenSIPS/opensips/commit/72e9c4325e9e148dee561acccbdffd0cfb4062bd
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M modules/mediaproxy/mediaproxy.c

  Log Message:
  -----------
  mediaproxy: bound SDP connection line insertion

Avoiding unsafe strncat() appends and check whether buffer fits.

Security advisory: GHSA-ggff-j9pg-p572

Thanks to zx (Jace) @manus-use on GitHub for the report.

(cherry picked from commit 0893129568e27d306163f8318617a14f61aeef8b)


  Commit: e7950dd88440e97cf1210b4ff6257ca96734b286
      https://github.com/OpenSIPS/opensips/commit/e7950dd88440e97cf1210b4ff6257ca96734b286
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-08-17 (Mon, 17 Aug 2026)

  Changed paths:
    M modules/pua/hash.c
    M modules/pua/hash.h
    M modules/pua/send_publish.c

  Log Message:
  -----------
  pua: reject overlong publish ETags

Reject too long SIP-ETag values before storing them from PUBLISH replies

Security advisory: GHSA-5w5j-xrr5-wr49

Thanks to zx (Jace) @manus-use on GitHub for the report.

(cherry picked from commit e12c990d2587e92814fafecb53dc54d7865ef8c5)


Compare: https://github.com/OpenSIPS/opensips/compare/9792b4884383...e7950dd88440

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications