There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade asterisk | Oct 17, 2018 | Aug 16, 2018 |
| Freebsd | — | Upgrade asterisk13Upgrade asterisk15 | Sep 21, 2018 | Sep 21, 2018 |
| Gentoo Linux | — | Upgrade net-misc/asterisk. | Nov 26, 2018 | Sep 24, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 24, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub