| Package | Affected versions | Patched versions |
|---|---|---|
| asterisk | ≥ 13.0.0, ≤ 13.23.0≥ 14.0.0, ≤ 14.7.7≥ 15.0.0, ≤ 15.6.0 | |
| certified asterisk | = 11.6= 13.1= 13.13= 13.21= 13.8 |
There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free