<div dir="ltr"><div>The earlier release announcement should NOT have had any User or Upgrade notes.</div><div><br></div><div>The Asterisk Development Team would like to announce security release  <br>Certified Asterisk 18.9-cert6.<br><br>The release artifacts are available for immediate download at  <br><a href="https://github.com/asterisk/asterisk/releases/tag/certified-18.9-cert6" target="_blank">https://github.com/asterisk/asterisk/releases/tag/certified-18.9-cert6</a><br>and<br><a href="https://downloads.asterisk.org/pub/telephony/certified-asterisk" target="_blank">https://downloads.asterisk.org/pub/telephony/certified-asterisk</a><br><br>The following security advisories were resolved in this release:<br>- [Path traversal via AMI GetConfig allows access to outside files](<a href="https://github.com/asterisk/asterisk/security/advisories/GHSA-8857-hfmw-vg8f" target="_blank">https://github.com/asterisk/asterisk/security/advisories/GHSA-8857-hfmw-vg8f</a>)<br>- [Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation](<a href="https://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq" target="_blank">https://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq</a>)<br>- [PJSIP logging allows attacker to inject fake Asterisk log entries ](<a href="https://github.com/asterisk/asterisk/security/advisories/GHSA-5743-x3p5-3rg7" target="_blank">https://github.com/asterisk/asterisk/security/advisories/GHSA-5743-x3p5-3rg7</a>)<br>- [PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update'](<a href="https://github.com/asterisk/asterisk/security/advisories/GHSA-98rc-4j27-74hh" target="_blank">https://github.com/asterisk/asterisk/security/advisories/GHSA-98rc-4j27-74hh</a>)<br><br><br>Change Log for Release asterisk-certified-18.9-cert6<br>========================================<br><br>Links:<br>----------------------------------------<br><br> - [Full ChangeLog](<a href="https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-certified-18.9-cert6.md" target="_blank">https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-certified-18.9-cert6.md</a>)  <br> - [GitHub Diff](<a href="https://github.com/asterisk/asterisk/compare/certified-18.9-cert5...certified-18.9-cert6" target="_blank">https://github.com/asterisk/asterisk/compare/certified-18.9-cert5...certified-18.9-cert6</a>)  <br> - [Tarball](<a href="https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-certified-18.9-cert6.tar.gz" target="_blank">https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-certified-18.9-cert6.tar.gz</a>)  <br> - [Downloads](<a href="https://downloads.asterisk.org/pub/telephony/asterisk" target="_blank">https://downloads.asterisk.org/pub/telephony/asterisk</a>)  <br><br>Summary:<br>----------------------------------------<br><br>- res_pjsip_header_funcs: Duplicate new header value, don't copy.<br>- res_rtp_asterisk.c: Check DTLS packets against ICE candidate list<br>- manager.c: Prevent path traversal with GetConfig.<br>- res_pjsip: disable raw bad packet logging<br><br>User Notes:<br>----------------------------------------<br><br>Upgrade Notes:<br>----------------------------------------<br><br>Closed Issues:<br>----------------------------------------<br><br>None<br></div></div>