CORRECTED asterisk release certified-18.9-cert6

--===============5352956130351341754==
Content-Type: multipart/alternative; boundary="000000000000a40107060c7e2e7f"

--000000000000a40107060c7e2e7f
Content-Type: text/plain; charset="UTF-8"

The earlier release announcement should NOT have had any User or Upgrade
notes.

The Asterisk Development Team would like to announce security release
Certified Asterisk 18.9-cert6.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-18.9-cert6
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk

The following security advisories were resolved in this release:
- [Path traversal via AMI GetConfig allows access to outside files](
https://github.com/asterisk/asterisk/security/advisories/GHSA-8857-hfmw-vg8f
)
- [Asterisk susceptible to Denial of Service via DTLS Hello packets during
call initiation](
https://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq
)
- [PJSIP logging allows attacker to inject fake Asterisk log entries ](
https://github.com/asterisk/asterisk/security/advisories/GHSA-5743-x3p5-3rg7
)
- [PJSIP_HEADER dialplan function can overwrite memory/cause crash when
using 'update'](
https://github.com/asterisk/asterisk/security/advisories/GHSA-98rc-4j27-74hh
)


Change Log for Release asterisk-certified-18.9-cert6
========================================

Links:
----------------------------------------

 - [Full ChangeLog](
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-certified-18.9-cert6.md)

 - [GitHub Diff](
https://github.com/asterisk/asterisk/compare/certified-18.9-cert5...certified-18.9-cert6)

 - [Tarball](
https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-certified-18.9-cert6.tar.gz)

 - [Downloads](https://downloads.asterisk.org/pub/telephony/asterisk)

Summary:
----------------------------------------

- res_pjsip_header_funcs: Duplicate new header value, don't copy.
- res_rtp_asterisk.c: Check DTLS packets against ICE candidate list
- manager.c: Prevent path traversal with GetConfig.
- res_pjsip: disable raw bad packet logging

User Notes:
----------------------------------------

Upgrade Notes:
----------------------------------------

Closed Issues:
----------------------------------------

None

--000000000000a40107060c7e2e7f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>The earlier release announcement should NOT have had =
any User or Upgrade notes.</div><div><br></div><div>The Asterisk Developmen=
t Team would like to announce security release =C2=A0<br>Certified Asterisk=
 18.9-cert6.<br><br>The release artifacts are available for immediate downl=
oad at =C2=A0<br><a href=3D"https://github.com/asterisk/asterisk/releases/t=
ag/certified-18.9-cert6" target=3D"_blank">https://github.com/asterisk/aste=
risk/releases/tag/certified-18.9-cert6</a><br>and<br><a href=3D"https://dow=
nloads.asterisk.org/pub/telephony/certified-asterisk" target=3D"_blank">htt=
ps://downloads.asterisk.org/pub/telephony/certified-asterisk</a><br><br>The=
 following security advisories were resolved in this release:<br>- [Path tr=
aversal via AMI GetConfig allows access to outside files](<a href=3D"https:=
//github.com/asterisk/asterisk/security/advisories/GHSA-8857-hfmw-vg8f" tar=
get=3D"_blank">https://github.com/asterisk/asterisk/security/advisories/GHS=
A-8857-hfmw-vg8f</a>)<br>- [Asterisk susceptible to Denial of Service via D=
TLS Hello packets during call initiation](<a href=3D"https://github.com/ast=
erisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq" target=3D"_blank">h=
ttps://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq=
</a>)<br>- [PJSIP logging allows attacker to inject fake Asterisk log entri=
es ](<a href=3D"https://github.com/asterisk/asterisk/security/advisories/GH=
SA-5743-x3p5-3rg7" target=3D"_blank">https://github.com/asterisk/asterisk/s=
ecurity/advisories/GHSA-5743-x3p5-3rg7</a>)<br>- [PJSIP_HEADER dialplan fun=
ction can overwrite memory/cause crash when using &#39;update&#39;](<a href=
=3D"https://github.com/asterisk/asterisk/security/advisories/GHSA-98rc-4j27=
-74hh" target=3D"_blank">https://github.com/asterisk/asterisk/security/advi=
sories/GHSA-98rc-4j27-74hh</a>)<br><br><br>Change Log for Release asterisk-=
certified-18.9-cert6<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br><b=
r>Links:<br>----------------------------------------<br><br>=C2=A0- [Full C=
hangeLog](<a href=3D"https://downloads.asterisk.org/pub/telephony/asterisk/=
releases/ChangeLog-certified-18.9-cert6.md" target=3D"_blank">https://downl=
oads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-certified-18.9-=
cert6.md</a>) =C2=A0<br>=C2=A0- [GitHub Diff](<a href=3D"https://github.com=
/asterisk/asterisk/compare/certified-18.9-cert5...certified-18.9-cert6" tar=
get=3D"_blank">https://github.com/asterisk/asterisk/compare/certified-18.9-=
cert5...certified-18.9-cert6</a>) =C2=A0<br>=C2=A0- [Tarball](<a href=3D"ht=
tps://downloads.asterisk.org/pub/telephony/asterisk/asterisk-certified-18.9=
-cert6.tar.gz" target=3D"_blank">https://downloads.asterisk.org/pub/telepho=
ny/asterisk/asterisk-certified-18.9-cert6.tar.gz</a>) =C2=A0<br>=C2=A0- [Do=
wnloads](<a href=3D"https://downloads.asterisk.org/pub/telephony/asterisk" =
target=3D"_blank">https://downloads.asterisk.org/pub/telephony/asterisk</a>=
) =C2=A0<br><br>Summary:<br>----------------------------------------<br><br=
>- res_pjsip_header_funcs: Duplicate new header value, don&#39;t copy.<br>-=
 res_rtp_asterisk.c: Check DTLS packets against ICE candidate list<br>- man=
ager.c: Prevent path traversal with GetConfig.<br>- res_pjsip: disable raw =
bad packet logging<br><br>User Notes:<br>----------------------------------=
------<br><br>Upgrade Notes:<br>----------------------------------------<br=
><br>Closed Issues:<br>----------------------------------------<br><br>None=
<br></div></div>

--000000000000a40107060c7e2e7f--


--===============5352956130351341754==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fXwotLSBCYW5kd2lkdGggYW5kIENvbG9jYXRpb24gUHJvdmlkZWQgYnkg
aHR0cDovL3d3dy5hcGktZGlnaXRhbC5jb20gLS0KCmFzdGVyaXNrLWRldiBtYWlsaW5nIGxpc3QK
VG8gVU5TVUJTQ1JJQkUgb3IgdXBkYXRlIG9wdGlvbnMgdmlzaXQ6CiAgIGh0dHA6Ly9saXN0cy5k
aWdpdW0uY29tL21haWxtYW4vbGlzdGluZm8vYXN0ZXJpc2stZGV2

--===============5352956130351341754==--