Software Update: Asterisk 15.6.1 / 14.7.8 / 13.23.1 / 13.21-cert3

Asterisk is a comprehensive pbx for BSD, Linux, and macOS. The program offers all the functions you would expect from a telephone exchange. For example, it has options for voicemail, conferencing and call queueing. In addition, support for caller id services, adsi, sip and h323 is present. For a complete overview of all options, we refer to this page† The developers have released Asterisk 15.6.1, 14.7.8, 13.23.1 and 13.21-cert3 with the following announcement:

Asterisk 13.23.1, 14.7.8, 15.6.1 and 13.21-cert3 Now Available (Security)

The Asterisk Development Team would like to announce security releases for Asterisk 13, 14 and 15, and Certified Asterisk 13.21. The available releases are released as versions 13.23.1, 14.7.8, 15.6.1 and 13.21-cert3.

These releases are available for immediate download at
releases
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

• AST-2018-009: Remote crash vulnerability in HTTP websocket upgrade There is a stack overflow vulnerability in the res_http_websocket.so module of Asterisk that allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket. The attacker’s request causes Asterisk to run out of stack space and crash.

For a full list of changes in the current releases, please see the ChangeLogs:
releases/ChangeLog-13.23.1
releases/ChangeLog-14.7.8
releases/ChangeLog-15.6.1
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.21-cert3

The security advisory is available at:
https://downloads.asterisk.org/pub/security/AST-2018-009.pdf

Thank you for your continued support of Asterisk!