Asterisk Development Team
2021-Jul-22 22:53 UTC
[asterisk-users] Asterisk 13.38.3, 16.19.1, 17.9.4, 18.5.1 and 16.8-cert10 Now Available (Security)
The Asterisk Development Team would like to announce security releases for
Asterisk 13, 16, 17 and 18, and Certified Asterisk 16.8. The available releases
are released as versions 13.38.3, 16.19.1, 17.9.4, 18.5.1 and 16.8-cert10.
These releases are available for immediate download at
https://downloads.asterisk.org/pub/telephony/asterisk/releases
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases
The following security vulnerabilities were resolved in these versions:
* AST-2021-007: Remote Crash Vulnerability in PJSIP channel driver
When Asterisk receives a re-INVITE without SDP after having sent a BYE request
a crash will occur. This occurs due to the Asterisk channel no longer being
present while code assumes it is.
* AST-2021-008: Remote crash when using IAX2 channel driver
If the IAX2 channel driver receives a packet that contains an
* AST-2021-009: pjproject/pjsip: crash when SSL socket destroyed during
handshake
Depending on the timing, it���s possible for Asterisk to crash when using a
TLS connection if the underlying socket parent/listener gets destroyed during
the handshake.
For a full list of changes in the current releases, please see the ChangeLogs:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.38.3
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-16.19.1
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-17.9.4
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-18.5.1
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-16.8-cert10
The security advisories are available at:
https://downloads.asterisk.org/pub/security/AST-2021-007.pdf
https://downloads.asterisk.org/pub/security/AST-2021-008.pdf
https://downloads.asterisk.org/pub/security/AST-2021-009.pdf
Thank you for your continued support of Asterisk!
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.digium.com/pipermail/asterisk-users/attachments/20210722/1bb6ba8c/attachment.html>