CVE-2018-17281

Name: CVE-2018-17281
Creator: NVD / NIST
Published: 2018-09-24T22:29:01.58+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 53.38%

Last modified Jun 17, 2026

CVE-2018-17281 is a vulnerability of currently unknown severity. There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.. EPSS estimates a 53.38% chance of exploitation in the next 30 days.

Description

There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.

Metrics

EPSS Probability

53.38%

98.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-400

Affected Software

Vendor	Product	Versions	Update
Digium	Asterisk	>= 13.0.0, <= 13.23.0	—
Digium	Asterisk	>= 14.0.0, <= 14.7.7	—
Digium	Asterisk	>= 15.0.0, <= 15.6.0	—
Digium	Certified Asterisk	11.6	Cert12
Digium	Certified Asterisk	13.1	Cert3
Digium	Certified Asterisk	13.8	Cert1
Digium	Certified Asterisk	13.13	Cert1
Digium	Certified Asterisk	13.21	Cert1
Debian	Debian Linux	8.0	—
Debian	Debian Linux	9.0	—

References

http://downloads.asterisk.org/pub/security/AST-2018-009.htmlPatch, Vendor Advisory
http://packetstormsecurity.com/files/149453/Asterisk-Project-Security-Advisory-AST-2018-009.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Sep/31Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/105389Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041694Third Party Advisory, VDB Entry
https://issues.asterisk.org/jira/browse/ASTERISK-28013Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00034.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2018/Sep/53Mailing List, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201811-11Third Party Advisory
https://www.debian.org/security/2018/dsa-4320Third Party Advisory
http://downloads.asterisk.org/pub/security/AST-2018-009.htmlPatch, Vendor Advisory
http://packetstormsecurity.com/files/149453/Asterisk-Project-Security-Advisory-AST-2018-009.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/Sep/31Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/105389Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041694Third Party Advisory, VDB Entry
https://issues.asterisk.org/jira/browse/ASTERISK-28013Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00034.htmlMailing List, Third Party Advisory
https://seclists.org/bugtraq/2018/Sep/53Mailing List, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201811-11Third Party Advisory
https://www.debian.org/security/2018/dsa-4320Third Party Advisory

Timeline

Published: Sep 24, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-17281?

How severe is CVE-2018-17281?

Severity scoring for CVE-2018-17281 is pending analysis. The EPSS model estimates a 53.38% probability of exploitation in the next 30 days.

How do I fix CVE-2018-17281?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-17281?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST