[OpenSIPS-Devel] [OpenSIPS/opensips] e14016: xmpp: prevent unauthenticated message URI overflow

[Răzvan Crainea]

  Branch: refs/heads/3.6
  Home:   https://github.com/OpenSIPS/opensips
  Commit: e14016db1e142e763d100750add3be79cb6e4fa0
      https://github.com/OpenSIPS/opensips/commit/e14016db1e142e763d100750add3be79cb6e4fa0
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-07 (Mon, 07 Sep 2026)

  Changed paths:
    M modules/pua_xmpp/xmpp2simple.c
    M modules/xmpp/util.c
    M modules/xmpp/xmpp.c
    M modules/xmpp/xmpp.h
    M modules/xmpp/xmpp_component.c
    M modules/xmpp/xmpp_server.c

  Log Message:
  -----------
  xmpp: prevent unauthenticated message URI overflow

Require the component handshake or server dialback validation before accepting inbound XMPP message stanzas.

Fixes GHSA-5gm5-wj62-p234

Reported-by: SecBuddyF KeenLab Tencent (CodeBuddy Security) <tinkerzf at gmail.com>
(cherry picked from commit ec24165bc25fa462e08cdb33ee8071f58e166d36)


  Commit: 8b9fff80d686aa856fb1b2220991a505caead76a
      https://github.com/OpenSIPS/opensips/commit/8b9fff80d686aa856fb1b2220991a505caead76a
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-07 (Mon, 07 Sep 2026)

  Changed paths:
    M modules/domainpolicy/domainpolicy.c

  Log Message:
  -----------
  domainpolicy: keep DURI buffer length in sync

Fixes GHSA-4vg3-hjjc-xv58

Reported-by: SecBuddyF KeenLab Tencent (CodeBuddy Security) <tinkerzf at gmail.com>
(cherry picked from commit 2d842e2e60e774cc9c2ab3c5dff7a6b63898948c)


  Commit: 4794414d7a3f79aaf2220d8f09735a37ae9fd6b7
      https://github.com/OpenSIPS/opensips/commit/4794414d7a3f79aaf2220d8f09735a37ae9fd6b7
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-07 (Mon, 07 Sep 2026)

  Changed paths:
    M modules/proto_msrp/msrp_parser.c
    M modules/proto_msrp/msrp_signaling.c

  Log Message:
  -----------
  proto_msrp: reject invalid To-Path header order

Require To-Path and From-Path to be the first MSRP headers in that
order, and guard the forwarding path against negative header span copies
before moving To-Path URLs into From-Path.

Fixes GHSA-qj7m-hgmv-pfrv

Reported-by: SecBuddyF KeenLab Tencent (CodeBuddy Security) <tinkerzf at gmail.com>
(cherry picked from commit adc1e4e5681ed8f1024ffb4b4cabaab6c2714d73)


  Commit: 2b5b3f431eff62a3c2cd50320c74d9b057d7f6c3
      https://github.com/OpenSIPS/opensips/commit/2b5b3f431eff62a3c2cd50320c74d9b057d7f6c3
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-07 (Mon, 07 Sep 2026)

  Changed paths:
    M modules/sip_i/sip_i.c

  Log Message:
  -----------
  sip_i: validate parsed ISUP parameter lengths

Fixes GHSA-qc7q-vrx3-3j4h

Reported-by: TristanInSec
(cherry picked from commit 635ce1737eb27b12a4a4f12a1f0a1b6a4ee2f92d)


  Commit: 3d00045abc16e4a36e0ee3cfbd31218c627cd631
      https://github.com/OpenSIPS/opensips/commit/3d00045abc16e4a36e0ee3cfbd31218c627cd631
  Author: Razvan Crainea <razvan at opensips.org>
  Date:   2026-09-07 (Mon, 07 Sep 2026)

  Changed paths:
    M modules/xmpp/util.c

  Log Message:
  -----------
  xmpp: reject overlong SIP-to-XMPP URIs early

Check the converted SIP-to-XMPP URI length before formatting it

Fixes GHSA-hwv5-237j-jq7m

Reported-by: TristanInSec
(cherry picked from commit d3620b9ba28867459d3ea9f74094355ce56145c8)


Compare: https://github.com/OpenSIPS/opensips/compare/613b69a11b13...3d00045abc16

To unsubscribe from these emails, change your notification settings at https://github.com/OpenSIPS/opensips/settings/notifications