The Asterisk Development Team would like to announce security releases
Asterisk 22.5.1, 21.10.1, 20.15.1, 18.26.3, Certified 20.7-cert7.
Asterisk 22.5.1, 21.10.1, 20.15.1, 18.26.3, Certified 20.7-cert7.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/22.5.1
https://github.com/asterisk/asterisk/releases/tag/21.10.1
https://github.com/asterisk/asterisk/releases/tag/20.15.1
https://github.com/asterisk/asterisk/releases/tag/18.26.3
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert7
and
https://downloads.asterisk.org/pub/telephony/asterisk
Repository: https://github.com/asterisk/asterisk
Tags: 22.5.1, 21.10.1, 20.15.1, 18.26.3, certified-20.7-cert7
Change Log
Links:
Summary:
- Commits: 2
- Commit Authors: 2
- Issues Resolved: 0
- Security Advisories Resolved: 2
- GHSA-mrq5-74j5-f5cr: Remote DoS and possible RCE in asterisk/res/res_stir_shaken/verification.c
- GHSA-v9q8-9j8m-5xwp: Uncontrolled Search-Path Element in safe_asterisk script may allow local privilege escalation.
User Notes:
Upgrade Notes:
-
safe_asterisk: Add ownership checks for /etc/asterisk/startup.d and its files.
The safe_asterisk script now checks that, if it was run by the
root user, the /etc/asterisk/startup.d directory and all the files it contains
are owned by root. If the checks fail, safe_asterisk will exit with an error
and Asterisk will not be started. Additionally, the default logging
destination is now stderr instead of tty “9” which probably won’t exist
in modern systems.
Developer Notes:
Commit Authors:
- George Joseph: (1)
- ThatTotallyRealMyth: (1)
Issue and Commit Detail:
Closed Issues:
- !GHSA-mrq5-74j5-f5cr: Remote DoS and possible RCE in asterisk/res/res_stir_shaken/verification.c
- !GHSA-v9q8-9j8m-5xwp: Uncontrolled Search-Path Element in safe_asterisk script may allow local privilege escalation.
Commits By Author:
-
George Joseph (1):
- res_stir_shaken: Test for missing semicolon in Identity header.
-
ThatTotallyRealMyth (1):
- safe_asterisk: Add ownership checks for /etc/asterisk/startup.d and its files.
Commit List:
- safe_asterisk: Add ownership checks for /etc/asterisk/startup.d and its files.
- res_stir_shaken: Test for missing semicolon in Identity header.