lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <842b2d72-6455-5064-8129-c53ed483cafc@sangoma.com> Date: Thu, 08 Aug 2024 13:28:49 +0000 From: Asterisk Development Team via Fulldisclosure <fulldisclosure@...lists.org> To: asterisk-dev@...ups.io, voipsec@...psa.org, fulldisclosure@...lists.org, asterisk+news@...coursemail.com Cc: Asterisk Development Team <asteriskteamsa@...goma.com> Subject: [FD] Asterisk Security Release 20.9.2 The Asterisk Development Team would like to announce security release Asterisk 20.9.2. The release artifacts are available for immediate download at https://github.com/asterisk/asterisk/releases/tag/20.9.2 and https://downloads.asterisk.org/pub/telephony/asterisk Repository: https://github.com/asterisk/asterisk Tag: 20.9.2 ## Change Log for Release asterisk-20.9.2 ### Links: - [Full ChangeLog](https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.9.2.md) - [GitHub Diff](https://github.com/asterisk/asterisk/compare/20.9.1...20.9.2) - [Tarball](https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-20.9.2.tar.gz) - [Downloads](https://downloads.asterisk.org/pub/telephony/asterisk) ### Summary: - Commits: 1 - Commit Authors: 1 - Issues Resolved: 0 - Security Advisories Resolved: 1 - [GHSA-c4cg-9275-6w44](https://github.com/asterisk/asterisk/security/advisories/GHSA-c4cg-9275-6w44): Write=originate, is sufficient permissions for code execution / System() dialplan ### User Notes: ### Upgrade Notes: ### Commit Authors: - George Joseph: (1) ## Issue and Commit Detail: ### Closed Issues: - !GHSA-c4cg-9275-6w44: Write=originate, is sufficient permissions for code execution / System() dialplan ### Commits By Author: - #### George Joseph (1): - manager.c: Add entries to Originate blacklist ### Commit List: - manager.c: Add entries to Originate blacklist ### Commit Details: #### manager.c: Add entries to Originate blacklist Author: George Joseph Date: 2024-07-22 Added Reload and DBdeltree to the list of dialplan application that can't be executed via the Originate manager action without also having write SYSTEM permissions. Added CURL, DB*, FILE, ODBC and REALTIME* to the list of dialplan functions that can't be executed via the Originate manager action without also having write SYSTEM permissions. If the Queue application is attempted to be run by the Originate manager action and an AGI parameter is specified in the app data, it'll be rejected unless the manager user has either the AGI or SYSTEM permissions. Resolves: #GHSA-c4cg-9275-6w44 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Powered by blists - more mailing lists