Homepage

Resource Exhaustion Affecting asterisk package, versions <1:13.23.1~dfsg-1

Severity

 Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
59.04% (98th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Resource Exhaustion vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIANUNSTABLE-ASTERISK-428857
  • published24 Sept 2018
  • disclosed24 Sept 2018
Report a new vulnerability Found a mistake?

Introduced: 24 Sep 2018

CVE-2018-17281  (opens in a new tab)
CWE-400  (opens in a new tab)

How to fix?

Upgrade Debian:unstable asterisk to version 1:13.23.1~dfsg-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream asterisk package and not the asterisk package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.