The Asterisk Development Team has announced security releases for Asterisk 11, 13, and 14, and for Certified Asterisk 11.6 and 13.13. The available security release versions are 11.25.3, 13.17.2, 14.6.2, 11.6-cert18, and 13.13-cert6.
These releases are available for immediate download at
The release of these versions resolves the following security vulnerabilities:
- AST-2017-008: Insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the “nat” and “symmetric_rtp” options allow redirecting where Asterisk sends the next RTCP report.
The RTP stream qualification to learn the source address of media always accepted the first RTP packet as the new source and allowed what AST-2017-005 was mitigating. The intent was to qualify a series of packets before accepting the new source address.
For a full list of changes in the current releases, please see the ChangeLogs:
The security advisories are available at:
Thank you for your continued support of Asterisk!