Sangoma · Asterisk · CVE-2018-17281
**Name of the Vulnerable Software and Affected Versions**
Asterisk versions 13.23.0 and earlier, 14.7.x through 14.7.7, 15.x through 15.6.0
Certified Asterisk versions 13.21-cert2 and earlier
**Description**
The issue is related to a stack consumption vulnerability in the res http websocket.so module. It can be exploited by an attacker via a specially crafted HTTP request to upgrade the connection to a websocket, potentially crashing Asterisk.
**Recommendations**
For Asterisk versions 13.23.0 and earlier, update to a version later than 13.23.0 to resolve the issue.
For Asterisk versions 14.7.x through 14.7.7, update to a version later than 14.7.7 to resolve the issue.
For Asterisk versions 15.x through 15.6.0, update to a version later than 15.6.0 to resolve the issue.
For Certified Asterisk versions 13.21-cert2 and earlier, update to a version later than 13.21-cert2 to resolve the issue.