The Asterisk Development Team would like to announce security releases for Asterisk 15, 13 and 14, and Certified Asterisk 13.18 and 13.21. The available releases are released as versions 15.4.1, 13.21.1, 14.7.7, 13.18-cert4 and 13.21-cert2.
These releases are available for immediate download at
https://downloads.asterisk.org/pub/telephony/asterisk/releases
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases
The following security vulnerabilities were resolved in these versions:
AST-2018-007: Infinite loop when reading iostreams
When connected to Asterisk via TCP/TLS if the client abruptly disconnects, or
sends a specially crafted message then Asterisk gets caught in an infinite
loop while trying to read the data stream. Thus rendering the system as
unusable.
AST-2018-008: PJSIP endpoint presence disclosure when using ACL
When endpoint specific ACL rules block a SIP request they respond with a 403
forbidden. However, if an endpoint is not identified then a 401 unauthorized
response is sent. This vulnerability just discloses which requests hit a
defined endpoint. The ACL rules cannot be bypassed to gain access to the
disclosed endpoints.
For a full list of changes in the current releases, please see the ChangeLogs:
ChangeLog-15.4.1
ChangeLog-13.21.1
ChangeLog-14.7.7
ChangeLog-certified-13.18-cert4
ChangeLog-certified-13.21-cert2
The security advisories are available at:
AST-2018-007.pdf
AST-2018-008.pdf
Thank you for your continued support of Asterisk!