CVE-2018-17281

Description

There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.

Weakness classification

• CWE-400: Uncontrolled Resource Consumption

Primary references

• cve@mitre.org — Patch, Vendor Advisory
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Mailing List, Patch, Third Party Advisory
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Third Party Advisory, VDB Entry
• cve@mitre.org — Issue Tracking, Third Party Advisory
• cve@mitre.org — Mailing List, Third Party Advisory
• cve@mitre.org — Mailing List, Patch, Third Party Advisory
• cve@mitre.org — Third Party Advisory
• cve@mitre.org — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry