Asterisk Development Team
2018-Sep-20 20:58 UTC
[asterisk-announce] Asterisk 13.23.1, 14.7.8, 15.6.1 and 13.21-cert3 Now Available (Security)
The Asterisk Development Team would like to announce security releases for Asterisk 13, 14 and 15, and Certified Asterisk 13.21. The available releases are released as versions 13.23.1, 14.7.8, 15.6.1 and 13.21-cert3. These releases are available for immediate download at https://downloads.asterisk.org/pub/telephony/asterisk/releases https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases The following security vulnerabilities were resolved in these versions: * AST-2018-009: Remote crash vulnerability in HTTP websocket upgrade There is a stack overflow vulnerability in the res_http_websocket.so module of Asterisk that allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket. The attacker���s request causes Asterisk to run out of stack space and crash. For a full list of changes in the current releases, please see the ChangeLogs: https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.23.1 https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-14.7.8 https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.6.1 https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.21-cert3 The security advisory is available at: https://downloads.asterisk.org/pub/security/AST-2018-009.pdf Thank you for your continued support of Asterisk! -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.digium.com/pipermail/asterisk-announce/attachments/20180920/a8c6aed3/attachment.html>
Possibly Parallel Threads
- AST-2018-009: Remote crash vulnerability in HTTP websocket upgrade
- Asterisk 13.19.2, 14.7.6, 15.2.2 and 13.18-cert3 Now Available (Security)
- AST-2014-019: Remote Crash Vulnerability in WebSocket Server
- AST-2014-019: Remote Crash Vulnerability in WebSocket Server
- Asterisk 1.8.15-cert6, 1.8.28.1, 11.6-cert3, 11.10.1, 12.3.1 Now Available (Security Release)