PJSIP's OpenSSL and GnuTLS backends improperly handle DNS SubjectAltName fields by copying them with string functions that recalculate length and truncate embedded NUL bytes. When server verification is enabled via --tls-verify-server, a certificate with a DNS SubjectAltName consisting of the target hostname prefix followed by an embedded NUL and attacker-controlled suffix can be accepted as valid for the prefix hostname. This allows an attacker possessing such a certificate from a trusted issuer and capable of intercepting the connection to impersonate the target server, complete SIP sessions, and obtain REGISTER credentials. The mbedTLS backend avoids this issue by preserving explicit string lengths. No fixed version is available as of the current review.

An attacker with a trusted certificate containing a crafted DNS SubjectAltName and the ability to intercept connections can impersonate the target server, potentially completing SIP sessions and capturing REGISTER credentials. This compromises confidentiality and integrity of SIP communications. The vulnerability does not affect availability. The mbedTLS backend is not vulnerable.

No official fix or patch is currently available for this vulnerability. Users should be aware of the risk when using OpenSSL or GnuTLS backends with server verification enabled. Consider using the mbedTLS backend as it is not affected. Monitor vendor advisories for updates and patches. Avoid relying solely on TLS server verification in affected versions until a fix is released.