Drachtio Drachtio-server — known CVE vulnerabilities

Every CVE whose affected-product data names Drachtio Drachtio-server, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (6)

• CVE-2022-45474 — CVSS 9.8 (critical): drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request.
• CVE-2022-45909 — CVSS 9.1 (critical): drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request.
• CVE-2022-47515 — CVSS 7.5 (high): An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long…
• CVE-2022-47516 — CVSS 7.5 (high): An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service…
• CVE-2022-47517 — CVSS 7.5 (high): An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service…
• CVE-2022-45473 — CVSS 5.5 (medium): In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666.