We're updating the issue view to help you get more done. 

Asterisk security release 17.8.1

Description

The Asterisk Development Team would like to announce security releases for
Asterisk 13, 16, 17 and 18, and Certified Asterisk 16.8. The available releases
are released as versions 13.37.1, 16.14.1, 17.8.1, 18.0.1 and 16.8-cert5.

These releases are available for immediate download at

https://downloads.asterisk.org/pub/telephony/asterisk/releases
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

AST-2020-001: Remote crash in res_pjsip_session
Upon receiving a new SIP Invite, Asterisk did not return the created dialog
locked or referenced.

AST-2020-002: Outbound INVITE loop on challenge with different nonce.
If Asterisk is challenged on an outbound INVITE and the nonce is changed in
each response, Asterisk will continually send INVITEs in a loop. This causes
Asterisk to consume more and more memory since the transaction will never
terminate (even if the call is hung up), ultimately leading to a restart or
shutdown of Asterisk. Outbound authentication must be configured on the
endpoint for this to occur.

Environment

None
Done

Assignee

Pascal Cadotte

Reporter

Pascal Cadotte

Labels

None

Approvers

François Blackburn

Pair

None

Sprint

None

Fix versions

Priority

Medium
Configure