The Asterisk Development Team would like to announce security releases for Asterisk 16, 18 and 19, and Certified Asterisk 16.8. The available releases are released as versions 16.25.2, 18.11.2, 19.3.2 and 16.8-cert14.

These releases are available for immediate download at

https://downloads.asterisk.org/pub/telephony/asterisk/releases https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

* AST-2022-001: res_stir_shaken: resource exhaustion with large files
When using STIR/SHAKEN, it’s possible to download files that are not
certificates. These files could be much larger than what you would expect to
download.

* AST-2022-002: res_stir_shaken: SSRF vulnerability with Identity header
When using STIR/SHAKEN, it’s possible to send arbitrary requests like GET to
interfaces such as localhost using the Identity header.

* AST-2022-003: func_odbc: Possible SQL Injection
Some databases can use backslashes to escape certain characters, such as
backticks. If input is provided to func_odbc which includes backslashes it is
possible for func_odbc to construct a broken SQL query and the SQL query to
fail.

For a full list of changes in the current releases, please see the ChangeLogs:

https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-16.25.2
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-18.11.2
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-19.3.2
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-16.8-cert14

The security advisories are available at:

https://downloads.asterisk.org/pub/security/AST-2022-001.pdf https://downloads.asterisk.org/pub/security/AST-2022-002.pdf https://downloads.asterisk.org/pub/security/AST-2022-003.pdf

Thank you for your continued support of Asterisk!