mirror of
https://github.com/ossrs/srs.git
synced 2026-11-04 12:10:20 +00:00
WinlinandClaude Opus 5.5
338b774b53
Fix bugs found while reviewing the security reports. * Security: Refuse a `..` in the app or stream name, always on. * GB28181: Fix heap overflow from a max-size RTP packet after a cut PS pack. * RTC: Check the DTLS certificate against the SDP fingerprint. * RTC: Fix crash from a STUN attribute without padding. * AMF0: Fix crash from deeply nested AMF0 objects. * JSON: Fix crash from deeply nested JSON. * TS: Fix crash from a malformed adaptation field. * Docs: Add the RTCP advisory and the supported versions for security fixes. The RTCP fix for these reports is already on develop in v8.0.73. ## Thanks We didn't accept every report as a security vulnerability, and some were duplicates or already fixed. But we really appreciate the work of every reporter. Because of all of you, the quality of SRS has improved. Thank you! | Report | Title | Author | |---|---|---| | GHSA-qr8h-p53p-x564 | RTCP crash and heap overflow | @ccsimplyspolit | | GHSA-4p49-8phx-p9j9 | RTCP heap overflow | @divinepwner | | GHSA-wv3p-399f-vxpc | RTCP length 0 crash | @jcross | | GHSA-2mcm-ghmj-xcjm | TWCC length 0 crash | @bararchy | | GHSA-jm96-w3mq-w7xh | Oversized TWCC overflow | @lyhtheori | | GHSA-g557-c4m9-prr2 | RTCP length overflow | @tylzars | | GHSA-7qgg-v57f-563q | RTCP heap overflow | @K-ANOY | | GHSA-836c-9rw5-4h92 | RTCP heap overflow | @thaidn | | GHSA-wv24-frvr-gv99 | RTCP and GB28181 overflows | @UnsignedWRLD | | GHSA-pvr5-r78m-r7hw | GB28181 TCP overflow | @akoul | | GHSA-f2rq-xx87-q8j9 | GB28181 TCP overflow | @TristanInSec | | GHSA-2cx5-qq53-9928 | GB28181 TCP overflow | @manop55555 | | GHSA-j8m9-p2mj-vr5j | RTP extension length crash | @afldl | | GHSA-jj89-8c9f-3r6p | RTP extension length crash | @songxpu | | GHSA-45p7-x4r8-fj9q | STUN padding crash | @K-ANOY | | GHSA-pp5h-vq2w-79rx | STUN padding crash | @tylzars | | GHSA-9xq6-j7r5-p3gw | STUN missing integrity check | @songxpu | | GHSA-9vpj-5cqr-wv6h | STUN request changes media address | @songxpu | | GHSA-4xc9-g94g-5c96 | DTLS fingerprint not checked | @songxpu | | GHSA-vf7r-44wh-wq25 | WebRTC session hijack chain | @songxpu | | GHSA-95hq-2fvc-gg2r | Client can turn off SRTP/DTLS | @songxpu | | GHSA-4gjf-mp3h-7hpj | SDP parser crashes | @damseleng | | GHSA-vpqj-6jqp-hmhw | WHIP SDP crash | @thaidn | | GHSA-5gwv-fphq-gvvq | TS adaptation field crash | @damseleng | | GHSA-6qgq-qx3x-4x2p | TS demuxer crash | @M0oo0ry | | GHSA-34jg-x79f-3w4q | AMF0 deep nesting crash | @wildoranges | | GHSA-88rx-78pg-w7cq | JSON deep nesting crash | @afldl | | GHSA-4j6x-mm32-cpxc | RTC session flood | @afldl | | GHSA-6cg9-jc65-g5c2 | Spoofed client IP, open control API | @Hama1cco | | GHSA-xgf8-p7r5-7xhq | `..` in stream name | @EgeBalci | | GHSA-h697-6cw4-qqr9 | `..` in app name | @y1zh3e7-zjm | | GHSA-hgf5-qh2r-4ph4 | `..` in app name | @am6539 | | GHSA-pg7p-6q9c-wrxh | `..` in stream name | @Sharlong-Wen | | GHSA-rhq3-46g9-q5wp | Proxy register API has no auth | @geo-chen | | GHSA-6m34-6jgr-ppfr | `/metrics` and `/console` not behind auth | @5ud0er | | GHSA-v8p7-v7vw-qcvg | Bundled OpenSSL 1.1.1l | @kobihikri | | GHSA-8vfx-p868-f5w9 | api-server demo path traversal | @DavidCarliez | | GHSA-x6mw-3458-894p | ffmpeg-webrtc CVE | @vulgraph | --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
542 B
542 B
Security Policy
We appreciate work to discover security vulnerabilities, but as SRS is entirely volunteer driven, so we might not be able to respond to issues in time.
Please click here to report a vulnerability.
Supported Versions
Security fixes go to SRS 6.0, 7.0 and 8.0. SRS 5.0 and older are end of life, so please upgrade.
The published advisories, with their vulnerable and patched versions, are in Security Advisories.