[OpenSIPS-Devel] [OpenSIPS/opensips] 92c254: xmpp: prevent unauthenticated message URI overflow

[Răzvan Crainea]

  Branch: refs/heads/4.0
  Home:   https://github.com/OpenSIPS/opensips
  Commit: 92c254efe78be8a86b8d134382b6319d052558c4
      https://github.com/OpenSIPS/opensips/commit/92c254efe78be8a86b8d134382b6319d052558c4
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-07 (Mon, 07 Sep 2026)

  Changed paths:
    M modules/pua_xmpp/xmpp2simple.c
    M modules/xmpp/util.c
    M modules/xmpp/xmpp.c
    M modules/xmpp/xmpp.h
    M modules/xmpp/xmpp_component.c
    M modules/xmpp/xmpp_server.c

  Log Message:
  -----------
  xmpp: prevent unauthenticated message URI overflow

Require the component handshake or server dialback validation before accepting inbound XMPP message stanzas.

Fixes GHSA-5gm5-wj62-p234

Reported-by: SecBuddyF KeenLab Tencent (CodeBuddy Security) <tinkerzf at gmail.com>
(cherry picked from commit ec24165bc25fa462e08cdb33ee8071f58e166d36)


  Commit: 739ceb11a066610684e3e67bbcb6754e338544bd
      https://github.com/OpenSIPS/opensips/commit/739ceb11a066610684e3e67bbcb6754e338544bd
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-07 (Mon, 07 Sep 2026)

  Changed paths:
    M modules/domainpolicy/domainpolicy.c

  Log Message:
  -----------
  domainpolicy: keep DURI buffer length in sync

Fixes GHSA-4vg3-hjjc-xv58

Reported-by: SecBuddyF KeenLab Tencent (CodeBuddy Security) <tinkerzf at gmail.com>
(cherry picked from commit 2d842e2e60e774cc9c2ab3c5dff7a6b63898948c)


  Commit: a8ad43e032d3345036c62c18550355e54a3e7aac
      https://github.com/OpenSIPS/opensips/commit/a8ad43e032d3345036c62c18550355e54a3e7aac
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-07 (Mon, 07 Sep 2026)

  Changed paths:
    M modules/proto_msrp/msrp_parser.c
    M modules/proto_msrp/msrp_signaling.c

  Log Message:
  -----------
  proto_msrp: reject invalid To-Path header order

Require To-Path and From-Path to be the first MSRP headers in that
order, and guard the forwarding path against negative header span copies
before moving To-Path URLs into From-Path.

Fixes GHSA-qj7m-hgmv-pfrv

Reported-by: SecBuddyF KeenLab Tencent (CodeBuddy Security) <tinkerzf at gmail.com>
(cherry picked from commit adc1e4e5681ed8f1024ffb4b4cabaab6c2714d73)


  Commit: 352def543851b015870c07a935de8a1a918078ae
      https://github.com/OpenSIPS/opensips/commit/352def543851b015870c07a935de8a1a918078ae
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-07 (Mon, 07 Sep 2026)

  Changed paths:
    M modules/sip_i/sip_i.c

  Log Message:
  -----------
  sip_i: validate parsed ISUP parameter lengths

Fixes GHSA-qc7q-vrx3-3j4h

Reported-by: TristanInSec
(cherry picked from commit 635ce1737eb27b12a4a4f12a1f0a1b6a4ee2f92d)


  Commit: 728ed6fc51aa5b9b7982d56ab707c64a5df97ecb
      https://github.com/OpenSIPS/opensips/commit/728ed6fc51aa5b9b7982d56ab707c64a5df97ecb
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-07 (Mon, 07 Sep 2026)

  Changed paths:
    M modules/xmpp/util.c

  Log Message:
  -----------
  xmpp: reject overlong SIP-to-XMPP URIs early

Check the converted SIP-to-XMPP URI length before formatting it

Fixes GHSA-hwv5-237j-jq7m

Reported-by: TristanInSec
(cherry picked from commit d3620b9ba28867459d3ea9f74094355ce56145c8)


  Commit: 6296f33df1cb6d147b21bc4270344d018e905e21
      https://github.com/OpenSIPS/opensips/commit/6296f33df1cb6d147b21bc4270344d018e905e21
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-07 (Mon, 07 Sep 2026)

  Changed paths:
    M modules/b2b_entities/dlg.c

  Log Message:
  -----------
  b2b_entities: fix reply Contact params bounds check

Fixes GHSA-5fj6-58f4-75r3

Reported-by: TristanInSec
(cherry picked from commit bfc4360989605f9048cc2a6789b74e2b8c22d945)


  Commit: 3282dc3cf45db56187e2267efd37b209caf1e927
      https://github.com/OpenSIPS/opensips/commit/3282dc3cf45db56187e2267efd37b209caf1e927
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-07 (Mon, 07 Sep 2026)

  Changed paths:
    M modules/b2b_entities/dlg.c

  Log Message:
  -----------
  b2b_entities: include request Contact params in bounds check

Account for Contact header parameter bytes when checking the fixed request extra-header buffer in b2breq_complete_ehdr().

Fixes GHSA-vq5g-56jm-839g

Reported-by: TristanInSec
(cherry picked from commit cb0dcbb9042b5635da9437a2cddb258b966e5e56)


Compare: https://github.com/OpenSIPS/opensips/compare/4bd1f73a36d5...3282dc3cf45d

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications