The earlier announcement should not have had any User or Upgrade notes.
The Asterisk Development Team would like to announce security release
Asterisk 21.0.1.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/21.0.1
and
https://downloads.asterisk.org/pub/telephony/asterisk
The following security advisories were resolved in this release:
- Path traversal via AMI GetConfig allows access to outside files
- Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation
- PJSIP logging allows attacker to inject fake Asterisk log entries
- PJSIP_HEADER dialplan function can overwrite memory/cause crash when using ‘update’
Change Log for Release asterisk-21.0.1