The Asterisk Development Team would like to announce security releases for
Asterisk 13, 14 and 15, and Certified Asterisk 13.18. The available releases are
released as versions 13.18.5, 14.7.5, 15.1.5 and 13.18-cert2.
These releases are available for immediate download at
https://downloads.asterisk.org/pub/telephony/asterisk/releases
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases
The following security vulnerabilities were resolved in these versions:
* AST-2017-014: Crash in PJSIP resource when missing a contact header
A select set of SIP messages create a dialog in Asterisk. Those SIP messages
must contain a contact header. For those messages, if the header was not
present and using the PJSIP channel driver, it would cause Asterisk to crash.
The severity of this vulnerability is somewhat mitigated if authentication is
enabled. If authentication is enabled a user would have to first be authorized
before reaching the crash point.
For a full list of changes in the current releases, please see the ChangeLogs:
ChangeLog-13.18.5
ChangeLog-14.7.5
ChangeLog-15.1.5
ChangeLog-certified-13.18-cert2
The security advisory is available at:
Thank you for your continued support of Asterisk!