The Asterisk project takes the issue of its users security seriously. If you believe you have found a security vulnerability in Asterisk, please follow the steps on this wiki page to report the security vulnerability to the Asterisk Development Team.
Reporting a Security Vulnerability
- Send an e-mail to the Asterisk Development Team by e-mailing firstname.lastname@example.org. Include the following:
- A summary of the suspected vulnerability, e.g., 'Remotely exploitable buffer overflow in the FOO channel driver'
- A detailed explanation of how the vulnerability can be exploited and/or reproduced. Test drivers/cases that can be used to demonstrate the vulnerability are highly appreciated.
- A developer will respond to your inquiry. If you'd like, e-mails can be signed and/or encrypted.
- A private issue will be created in the Asterisk issue tracker for your vulnerability. If you feel comfortable making a private issue in the issue tracker, you may also choose to do this.
Security vulnerabilities are treated seriously by the developer community, and the Asterisk Development Team always attempts to address vulnerabilities in a timely fashion. Sometimes, external influences may impact when a security release can be made; feel free to e-mail the developer assigned to the issue or email@example.com to discuss the schedule for a security release for your issue.
Past Security Vulnerabilities
All security vulnerabilities are also issued a CVE number and can be queried in the CVE database.