Asterisk
/
asterisk
mirror of https://github.com/asterisk/asterisk
1
0
Fork 0
Code Issues Releases Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '21.7.0-rc1'
${ noResults }
asterisk/ChangeLogs/ChangeLog-21.6.1.md

1.9 KiB
Raw Permalink Blame History

Change Log for Release asterisk-21.6.1

Links:

Summary:

  • Commits: 1
  • Commit Authors: 1
  • Issues Resolved: 0
  • Security Advisories Resolved: 1

User Notes:

  • manager.c: Restrict ListCategories to the configuration directory.

    The ListCategories AMI action now restricts files to the configured configuration directory.

Upgrade Notes:

Commit Authors:

  • Ben Ford: (1)

Issue and Commit Detail:

Closed Issues:

  • !GHSA-33x6-fj46-6rfh: Path traversal via AMI ListCategories allows access to outside files

Commits By Author:

  • Ben Ford (1):

    • manager.c: Restrict ListCategories to the configuration directory.

Commit List:

  • manager.c: Restrict ListCategories to the configuration directory.

Commit Details:

manager.c: Restrict ListCategories to the configuration directory.

Author: Ben Ford Date: 2024-12-17

When using the ListCategories AMI action, it was possible to traverse upwards through the directories to files outside of the configured configuration directory. This action is now restricted to the configured directory and an error will now be returned if the specified file is outside of this limitation.

Resolves: #GHSA-33x6-fj46-6rfh

UserNote: The ListCategories AMI action now restricts files to the configured configuration directory.