---
- branch: MAIN
  date: Sun Feb 28 22:48:07 UTC 2021
  files:
  - new: '1.68'
    old: '1.67'
    path: pkgsrc/comms/asterisk13/Makefile
    pathrev: pkgsrc/comms/asterisk13/Makefile@1.68
    type: modified
  - new: '1.18'
    old: '1.17'
    path: pkgsrc/comms/asterisk13/distinfo
    pathrev: pkgsrc/comms/asterisk13/distinfo@1.18
    type: modified
  id: 20210228T224807Z.6824027ae4aa87893057385890c865b2c369bb10
  log: |
    asterisk13:  Update to Asterisk 13.38.2:

    The Asterisk Development Team would like to announce security releases for
    Asterisk 13, 16, 17 and 18, and Certified Asterisk 16.8. The available releases
    are released as versions 13.38.2, 16.16.1, 17.9.2, 18.2.1 and 16.8-cert6.

    These releases are available for immediate download at

    https://downloads.asterisk.org/pub/telephony/asterisk/releases
    https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

    The following security vulnerabilities were resolved in these versions:

    * AST-2021-001: Remote crash in res_pjsip_diversion
      If a registered user is tricked into dialing a

    * AST-2021-002: Remote crash possible when negotiating T.38
      When

    * AST-2021-003: Remote attacker could prematurely tear down SRTP calls
      An unauthenticated remote attacker could replay SRTP packets which could cause
      an Asterisk instance configured without strict RTP validation to tear down
      calls prematurely.

    * AST-2021-004: An unsuspecting user could crash Asterisk with multiple
                    hold/unhold requests
      Due to a signedness comparison mismatch, an authenticated WebRTC client could
      cause a stack overflow and Asterisk crash by sending multiple hold/unhold
      requests in quick succession.

    * AST-2021-005: Remote Crash Vulnerability in PJSIP channel driver
      Given a scenario where an outgoing call is placed from Asterisk to a remote
      SIP server it is possible for a crash to occur.

    For a full list of changes in the current releases, please see the ChangeLogs:

    https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.38.2

    The security advisories are available at:

    https://downloads.asterisk.org/pub/security/AST-2021-001.pdf
    https://downloads.asterisk.org/pub/security/AST-2021-002.pdf
    https://downloads.asterisk.org/pub/security/AST-2021-003.pdf
    https://downloads.asterisk.org/pub/security/AST-2021-004.pdf
    https://downloads.asterisk.org/pub/security/AST-2021-005.pdf

    Thank you for your continued support of Asterisk!
  module: pkgsrc
  subject: 'CVS commit: pkgsrc/comms/asterisk13'
  unixtime: '1614552487'
  user: jnemeth