The Asterisk Development Team would like to announce security release
Asterisk 21.0.1.
The release artifacts are available for immediate download at
and
https://downloads.asterisk.org/pub/telephony/asterisk
The following security advisories were resolved in this release:
- Path traversal via AMI GetConfig allows access to outside files
- Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation
- PJSIP logging allows attacker to inject fake Asterisk log entries
- PJSIP_HEADER dialplan function can overwrite memory/cause crash when using ‘update’
Change Log for Release asterisk-21.0.1