CVE-2018-17281
24.09.2018, 22:29
There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.Enginsight
| Vendor | Product | Version |
|---|---|---|
| digium | asterisk | 13.0.0 ≤ 𝑥 ≤ 13.23.0 |
| digium | asterisk | 14.0.0 ≤ 𝑥 ≤ 14.7.7 |
| digium | asterisk | 15.0.0 ≤ 𝑥 ≤ 15.6.0 |
| digium | certified_asterisk | 11.6:cert12 |
| digium | certified_asterisk | 11.6:cert13 |
| digium | certified_asterisk | 11.6:cert14 |
| digium | certified_asterisk | 11.6:cert15 |
| digium | certified_asterisk | 11.6:cert16 |
| digium | certified_asterisk | 11.6:cert17 |
| digium | certified_asterisk | 11.6:cert18 |
| digium | certified_asterisk | 13.1:cert3 |
| digium | certified_asterisk | 13.1:cert4 |
| digium | certified_asterisk | 13.1:cert5 |
| digium | certified_asterisk | 13.1:cert6 |
| digium | certified_asterisk | 13.1:cert7 |
| digium | certified_asterisk | 13.1:cert8 |
| digium | certified_asterisk | 13.8:cert1 |
| digium | certified_asterisk | 13.8:cert2 |
| digium | certified_asterisk | 13.8:cert3 |
| digium | certified_asterisk | 13.8:cert4 |
| digium | certified_asterisk | 13.13:cert1 |
| digium | certified_asterisk | 13.13:cert2 |
| digium | certified_asterisk | 13.13:cert3 |
| digium | certified_asterisk | 13.13:cert4 |
| digium | certified_asterisk | 13.13:cert5 |
| digium | certified_asterisk | 13.13:cert6 |
| digium | certified_asterisk | 13.13:cert7 |
| digium | certified_asterisk | 13.13:cert8 |
| digium | certified_asterisk | 13.13:cert9 |
| digium | certified_asterisk | 13.21:cert1 |
| digium | certified_asterisk | 13.21:cert2 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References