[asterisk-dev] Asterisk 16.25.2, 18.11.2, 19.3.2 and 16.8-cert14 Now Available (Security)

Asterisk Development Team asteriskteam at digium.com
Thu Apr 14 17:57:18 CDT 2022

The Asterisk Development Team would like to announce security releases for
Asterisk 16, 18 and 19, and Certified Asterisk 16.8. The available releases are
released as versions 16.25.2, 18.11.2, 19.3.2 and 16.8-cert14.

These releases are available for immediate download at


The following security vulnerabilities were resolved in these versions:

* AST-2022-001: res_stir_shaken: resource exhaustion with large files
  When using STIR/SHAKEN, it���s possible to download files that are not
  certificates. These files could be much larger than what you would expect to

* AST-2022-002: res_stir_shaken: SSRF vulnerability with Identity header
  When using STIR/SHAKEN, it���s possible to send arbitrary requests like GET to
  interfaces such as localhost using the Identity header.

* AST-2022-003: func_odbc: Possible SQL Injection
  Some databases can use backslashes to escape certain characters, such as
  backticks. If input is provided to func_odbc which includes backslashes it is
  possible for func_odbc to construct a broken SQL query and the SQL query to

For a full list of changes in the current releases, please see the ChangeLogs:


The security advisories are available at:


Thank you for your continued support of Asterisk!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-dev/attachments/20220414/4fec69e9/attachment.html>

More information about the asterisk-dev mailing list