Asterisk 22.1.1: One Small Step for Security, One Giant Leap for Directory Safety
The Asterisk Development Team has rolled out security release Asterisk 22.1.1, finally putting an end to accidental file tourism via AMI ListCategories. You can download this update faster than you can say “path traversal” at their official GitHub and download page. Happy secure calling!
Hot Take:
Well, well, well, it looks like the Asterisk Development Team has finally plugged a hole that could have had hackers playing peek-a-boo with your sensitive files! Kudos to them for locking the door and throwing away the key, but let’s hope this isn’t the start of a reality show called “Hacker Cribs”!
Key Points:
- Asterisk has released a security update, version 22.1.1, to address a vulnerability.
- The vulnerability involved path traversal via the AMI ListCategories action.
- This flaw allowed unauthorized access to files outside the designated configuration directory.
- Only one commit was made to resolve this issue, authored by Ben Ford.
- The update ensures that ListCategories is now restricted to the configuration directory.
Already a member? Log in here