The Asterisk Development Team would like to announce security releases for Asterisk 13, 14 and 15, and Certified Asterisk 13.21. The available releases are released as versions 13.23.1, 14.7.8, 15.6.1 and 13.21-cert3.

These releases are available for immediate download at

https://downloads.asterisk.org/pub/telephony/asterisk/releases https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

* AST-2018-009: Remote crash vulnerability in HTTP websocket upgrade
There is a stack overflow vulnerability in the res_http_websocket.so module of
Asterisk that allows an attacker to crash Asterisk via a specially crafted
HTTP request to upgrade the connection to a websocket. The attacker’s
request causes Asterisk to run out of stack space and crash.

For a full list of changes in the current releases, please see the ChangeLogs:

https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.23.1
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-14.7.8
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-15.6.1
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.21-cert3

The security advisory is available at:

https://downloads.asterisk.org/pub/security/AST-2018-009.pdf

Thank you for your continued support of Asterisk!