The earlier release announcement should NOT have had any User or Upgrade notes.
The Asterisk Development Team would like to announce security release
Certified Asterisk 18.9-cert6.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-18.9-cert6
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk
The following security advisories were resolved in this release:
- Path traversal via AMI GetConfig allows access to outside files
- Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation
- PJSIP logging allows attacker to inject fake Asterisk log entries
- PJSIP_HEADER dialplan function can overwrite memory/cause crash when using ‘update’
Change Log for Release asterisk-certified-18.9-cert6