Asterisk Development Team
2018-Jun-11 22:29 UTC
[asterisk-users] Asterisk 15.4.1, 13.21.1, 14.7.7, 13.18-cert4 and 13.21-cert2 Now Available (Security)
The Asterisk Development Team would like to announce security releases for Asterisk 15, 13 and 14, and Certified Asterisk 13.18 and 13.21. The available releases are released as versions 15.4.1, 13.21.1, 14.7.7, 13.18-cert4 and 13.21-cert2. These releases are available for immediate download at https://downloads.asterisk.org/pub/telephony/asterisk/releases https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases The following security vulnerabilities were resolved in these versions: * AST-2018-007: Infinite loop when reading iostreams When connected to Asterisk via TCP/TLS if the client abruptly disconnects, or sends a specially crafted message then Asterisk gets caught in an infinite loop while trying to read the data stream. Thus rendering the system as unusable. * AST-2018-008: PJSIP endpoint presence disclosure when using ACL When endpoint specific ACL rules block a SIP request they respond with a 403 forbidden. However, if an endpoint is not identified then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed endpoints. For a full list of changes in the current releases, please see the ChangeLogs: https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.4.1 https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.21.1 https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-14.7.7 https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.18-cert4 https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.21-cert2 The security advisories are available at: https://downloads.asterisk.org/pub/security/AST-2018-007.pdf https://downloads.asterisk.org/pub/security/AST-2018-008.pdf Thank you for your continued support of Asterisk! -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20180611/ba7ea2f0/attachment.html>