Sean Bright

**Name of the Vulnerable Software and Affected Versions** Asterisk versions 13.23.0 and earlier, 14.7.x through 14.7.7, 15.x through 15.6.0 Certified Asterisk versions 13.21-cert2 and earlier **Description** The issue is related to a stack consumption vulnerability in the res http websocket.so module. It can be exploited by an attacker via a specially crafted HTTP request to upgrade the connection to a websocket, potentially crashing Asterisk. **Recommendations** For Asterisk versions 13.23.0 and earlier, update to a version later than 13.23.0 to resolve the issue. For Asterisk versions 14.7.x through 14.7.7, update to a version later than 14.7.7 to resolve the issue. For Asterisk versions 15.x through 15.6.0, update to a version later than 15.6.0 to resolve the issue. For Certified Asterisk versions 13.21-cert2 and earlier, update to a version later than 13.21-cert2 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Asterisk Open Source versions 15.x before 15.4.1 **Description** An issue was discovered in Asterisk Open Source. When connected to Asterisk via TCP/TLS, if the client abruptly disconnects, or sends a specially crafted message, then Asterisk gets caught in an infinite loop while trying to read the data stream. This renders the system unusable. **Recommendations** For Asterisk Open Source versions 15.x before 15.4.1, update to version 15.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the TCP/TLS connection to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Asterisk versions 15.x through 15.2.1 **Description** An issue in the `res http websocket.c` file causes the Asterisk system to mishandle WebSocket payloads of size 0, resulting in a busy loop when the HTTP server is enabled. **Recommendations** For Asterisk versions 15.x through 15.2.1, consider disabling the HTTP server as a temporary workaround to minimize the risk of exploitation.