Asterisk 13.38.2, 16.16.1, 17.9.2, 18.2.1 and 16.8-cert6 Now Available (Security)

["Asterisk Development Team" <asteriskteam@xxxxxxxxxx>]

The Asterisk Development Team would like to announce security releases for
Asterisk 13, 16, 17 and 18, and Certified Asterisk 16.8. The available releases
are released as versions 13.38.2, 16.16.1, 17.9.2, 18.2.1 and 16.8-cert6.

These releases are available for immediate download at

https://downloads.asterisk.org/pub/telephony/asterisk/releases
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

• AST-2021-001: Remote crash in res_pjsip_diversion
  If a registered user is tricked into dialing a
  


• AST-2021-002: Remote crash possible when negotiating T.38
  When
  


• AST-2021-003: Remote attacker could prematurely tear down SRTP calls
  An unauthenticated remote attacker could replay SRTP packets which could cause
  an Asterisk instance configured without strict RTP validation to tear down
  calls prematurely.
  


• AST-2021-004: An unsuspecting user could crash Asterisk with multiple
                  hold/unhold requests
  Due to a signedness comparison mismatch, an authenticated WebRTC client could
  cause a stack overflow and Asterisk crash by sending multiple hold/unhold
  requests in quick succession.
  


• AST-2021-005: Remote Crash Vulnerability in PJSIP channel driver
  Given a scenario where an outgoing call is placed from Asterisk to a remote
  SIP server it is possible for a crash to occur.
  

For a full list of changes in the current releases, please see the ChangeLogs:

ChangeLog-13.38.2
ChangeLog-16.16.1
ChangeLog-17.9.2
ChangeLog-18.2.1
ChangeLog-certified-16.8-cert6

The security advisories are available at:

AST-2021-001.pdf
AST-2021-002.pdf
AST-2021-003.pdf
AST-2021-004.pdf
AST-2021-005.pdf

Thank you for your continued support of Asterisk!
-- 
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

asterisk-announce mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-announce