CVE-2018-17281

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-17281
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-17281.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-17281
Downstream
Published
2018-09-24T22:29:01.580Z
Modified
2026-07-08T05:51:06.923557263Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

There is a stack consumption vulnerability in the reshttpwebsocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux",
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/asterisk/asterisk

Affected ranges

Type
GIT
Repo
https://github.com/asterisk/asterisk
Events
Introduced
85335355efb2d7914a1fe20ed31afcef15fd210c
Last affected
8ac08a916c7fcc1ceecf3d682a1877c46deab626
Introduced
c6d6dd133c3db3b202f1f0d457780c9a6d841e0f
Last affected
fdaecead781e4216a68c672ad0864ca895a47141
Introduced
d4cc63728def7ca06ad3f70547de87bc5c9ef7c0
Last affected
8b6edb7502ee79f73ce3d8396e8f06ce00f8f042
Introduced
bf004c4584649d080979c4f877a6e9d3e793467c
Last affected
742007f881f8cb04fe543fba4dbe5404589d9f14
Database specific 
{
    "cpe": [
        "cpe:2.3:a:digium:asterisk:*:*:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:digium:asterisk:*:*:*:*:standard:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:11.6:cert12:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:11.6:cert13:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:11.6:cert14:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:11.6:cert15:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:11.6:cert16:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:11.6:cert17:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:11.6:cert18:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.1:cert3:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.1:cert4:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.1:cert5:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.1:cert6:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.1:cert7:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.1:cert8:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.8:cert1:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.8:cert2:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.8:cert3:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.8:cert4:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.13:cert1:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.13:cert2:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.13:cert3:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.13:cert4:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.13:cert5:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.13:cert6:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.13:cert7:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.13:cert8:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.13:cert9:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.21:cert1:*:*:lts:*:*:*",
        "cpe:2.3:a:digium:certified_asterisk:13.21:cert2:*:*:lts:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "13.0.0"
        },
        {
            "last_affected": "13.23.0"
        },
        {
            "introduced": "14.0.0"
        },
        {
            "last_affected": "14.7.7"
        },
        {
            "introduced": "15.0.0"
        },
        {
            "last_affected": "15.6.0"
        },
        {
            "introduced": "11.6-cert12"
        },
        {
            "last_affected": "11.6-cert12"
        },
        {
            "introduced": "11.6-cert13"
        },
        {
            "last_affected": "11.6-cert13"
        },
        {
            "introduced": "11.6-cert14"
        },
        {
            "last_affected": "11.6-cert14"
        },
        {
            "introduced": "11.6-cert15"
        },
        {
            "last_affected": "11.6-cert15"
        },
        {
            "introduced": "11.6-cert16"
        },
        {
            "last_affected": "11.6-cert16"
        },
        {
            "introduced": "11.6-cert17"
        },
        {
            "last_affected": "11.6-cert17"
        },
        {
            "introduced": "11.6-cert18"
        },
        {
            "last_affected": "11.6-cert18"
        },
        {
            "introduced": "13.1-cert3"
        },
        {
            "last_affected": "13.1-cert3"
        },
        {
            "introduced": "13.1-cert4"
        },
        {
            "last_affected": "13.1-cert4"
        },
        {
            "introduced": "13.1-cert5"
        },
        {
            "last_affected": "13.1-cert5"
        },
        {
            "introduced": "13.1-cert6"
        },
        {
            "last_affected": "13.1-cert6"
        },
        {
            "introduced": "13.1-cert7"
        },
        {
            "last_affected": "13.1-cert7"
        },
        {
            "introduced": "13.1-cert8"
        },
        {
            "last_affected": "13.1-cert8"
        },
        {
            "introduced": "13.8-cert1"
        },
        {
            "last_affected": "13.8-cert1"
        },
        {
            "introduced": "13.8-cert2"
        },
        {
            "last_affected": "13.8-cert2"
        },
        {
            "introduced": "13.8-cert3"
        },
        {
            "last_affected": "13.8-cert3"
        },
        {
            "introduced": "13.8-cert4"
        },
        {
            "last_affected": "13.8-cert4"
        },
        {
            "introduced": "13.13-cert1"
        },
        {
            "last_affected": "13.13-cert1"
        },
        {
            "introduced": "13.13-cert2"
        },
        {
            "last_affected": "13.13-cert2"
        },
        {
            "introduced": "13.13-cert3"
        },
        {
            "last_affected": "13.13-cert3"
        },
        {
            "introduced": "13.13-cert4"
        },
        {
            "last_affected": "13.13-cert4"
        },
        {
            "introduced": "13.13-cert5"
        },
        {
            "last_affected": "13.13-cert5"
        },
        {
            "introduced": "13.13-cert6"
        },
        {
            "last_affected": "13.13-cert6"
        },
        {
            "introduced": "13.13-cert7"
        },
        {
            "last_affected": "13.13-cert7"
        },
        {
            "introduced": "13.13-cert8"
        },
        {
            "last_affected": "13.13-cert8"
        },
        {
            "introduced": "13.13-cert9"
        },
        {
            "last_affected": "13.13-cert9"
        },
        {
            "introduced": "13.21-cert1"
        },
        {
            "last_affected": "13.21-cert1"
        },
        {
            "introduced": "13.21-cert2"
        },
        {
            "last_affected": "13.21-cert2"
        }
    ]
}

Affected versions

11.*
11.6-cert12
11.6-cert13
11.6-cert14
11.6-cert15
11.6-cert16
11.6-cert17
11.6-cert18
13.*
13.1-cert3
13.1-cert4
13.1-cert5
13.1-cert6
13.1-cert7
13.1-cert8
13.13-cert1
13.13-cert2
13.13-cert3
13.13-cert4
13.13-cert5
13.13-cert6
13.13-cert7
13.13-cert8
13.13-cert9
13.21-cert1
13.21-cert2
13.8-cert1
13.8-cert2
13.8-cert3
13.8-cert4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-17281.json"