diff --git a/.version b/.version index 8bb4541a4ebb2d279a0056966c709c2de100966d..7bf20f5b8d873e258a619d20321bc5582ad2edef 100644 --- a/.version +++ b/.version @@ -1 +1 @@ -21.4.1 +21.4.2 diff --git a/CHANGES.md b/CHANGES.md index 0e9bf588b560af0e3f5b3f746e7b81e6d37fb641..8d167f79af95226499cf32e250db023f870b6793 120000 --- a/CHANGES.md +++ b/CHANGES.md @@ -1 +1 @@ -ChangeLogs/ChangeLog-21.4.1.md \ No newline at end of file +ChangeLogs/ChangeLog-21.4.2.md \ No newline at end of file diff --git a/ChangeLogs/ChangeLog-21.4.2.md b/ChangeLogs/ChangeLog-21.4.2.md new file mode 100644 index 0000000000000000000000000000000000000000..e3a09275ae4fc99ad5601ae3cb15fce8240929fc --- /dev/null +++ b/ChangeLogs/ChangeLog-21.4.2.md @@ -0,0 +1,65 @@ + +## Change Log for Release asterisk-21.4.2 + +### Links: + + - [Full ChangeLog](https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-21.4.2.md) + - [GitHub Diff](https://github.com/asterisk/asterisk/compare/21.4.1...21.4.2) + - [Tarball](https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-21.4.2.tar.gz) + - [Downloads](https://downloads.asterisk.org/pub/telephony/asterisk) + +### Summary: + +- Commits: 1 +- Commit Authors: 1 +- Issues Resolved: 0 +- Security Advisories Resolved: 1 + - [GHSA-c4cg-9275-6w44](https://github.com/asterisk/asterisk/security/advisories/GHSA-c4cg-9275-6w44): Write=originate, is sufficient permissions for code execution / System() dialplan + +### User Notes: + + +### Upgrade Notes: + + +### Commit Authors: + +- George Joseph: (1) + +## Issue and Commit Detail: + +### Closed Issues: + + - !GHSA-c4cg-9275-6w44: Write=originate, is sufficient permissions for code execution / System() dialplan + +### Commits By Author: + +- #### George Joseph (1): + - manager.c: Add entries to Originate blacklist + + +### Commit List: + +- manager.c: Add entries to Originate blacklist + +### Commit Details: + +#### manager.c: Add entries to Originate blacklist + Author: George Joseph + Date: 2024-07-22 + + Added Reload and DBdeltree to the list of dialplan application that + can't be executed via the Originate manager action without also + having write SYSTEM permissions. + + Added CURL, DB*, FILE, ODBC and REALTIME* to the list of dialplan + functions that can't be executed via the Originate manager action + without also having write SYSTEM permissions. + + If the Queue application is attempted to be run by the Originate + manager action and an AGI parameter is specified in the app data, + it'll be rejected unless the manager user has either the AGI or + SYSTEM permissions. + + Resolves: #GHSA-c4cg-9275-6w44 +