CVE-2023-4883 - Multiple vulnerabilities in Open5GS

Back Back to CVE browser

HIGH

Multiple vulnerabilities in Open5GS

Published Oct 3, 2023

7.5

HIGH

CVSS 3.1

EPSS 0.62%

Description

Invalid pointer release vulnerability. Exploitation of this vulnerability could allow an attacker to interrupt the correct operation of the service by sending a specially crafted json string to the VNF (Virtual Network Function), and triggering the ogs_sbi_message_free function, which could cause a service outage.

Affected products

Vendor Open5GS Product Open5GS Default
unaffected
- Version
  2.4.10 and prior
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Open5GS

unaffected

Version	Status	Constraints
2.4.10 and prior	affected	-

Remediation

Vendor solution

Open5GS is working on a fix for the reported vulnerabilities.

Weaknesses (1)

CWE-763

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54722
Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54722		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-open5gs		Third Party Advisory