Asterisk 15.4.1, 13.21.1, 14.7.7, 13.18-cert4 and 13.21-cert2 Now Available (Security)

["Asterisk Development Team" <asteriskteam@xxxxxxxxxx>]

The Asterisk Development Team would like to announce security releases for
Asterisk 15, 13 and 14, and Certified Asterisk 13.18 and 13.21. The available
releases are released as versions 15.4.1, 13.21.1, 14.7.7, 13.18-cert4 and
13.21-cert2.

These releases are available for immediate download at

https://downloads.asterisk.org/pub/telephony/asterisk/releases
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

• AST-2018-007: Infinite loop when reading iostreams
  When connected to Asterisk via TCP/TLS if the client abruptly disconnects, or
  sends a specially crafted message then Asterisk gets caught in an infinite
  loop while trying to read the data stream. Thus rendering the system as
  unusable.
  


• AST-2018-008: PJSIP endpoint presence disclosure when using ACL
  When endpoint specific ACL rules block a SIP request they respond with a 403
  forbidden. However, if an endpoint is not identified then a 401 unauthorized
  response is sent. This vulnerability just discloses which requests hit a
  defined endpoint. The ACL rules cannot be bypassed to gain access to the
  disclosed endpoints.
  

For a full list of changes in the current releases, please see the ChangeLogs:

ChangeLog-15.4.1
ChangeLog-13.21.1
ChangeLog-14.7.7
ChangeLog-certified-13.18-cert4
ChangeLog-certified-13.21-cert2

The security advisories are available at:

AST-2018-007.pdf
AST-2018-008.pdf

Thank you for your continued support of Asterisk!
-- 
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

asterisk-announce mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-announce