Update for 21.4.2

diff --git a/.version b/.version
index 8bb4541a4ebb2d279a0056966c709c2de100966d..7bf20f5b8d873e258a619d20321bc5582ad2edef 100644 (file)
--- a/.version
+++ b/.version
@@ -1 +1 @@
-21.4.1
+21.4.2

diff --git a/CHANGES.md b/CHANGES.md
index 0e9bf588b560af0e3f5b3f746e7b81e6d37fb641..8d167f79af95226499cf32e250db023f870b6793 120000 (symlink)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1 +1 @@
-ChangeLogs/ChangeLog-21.4.1.md
\ No newline at end of file
+ChangeLogs/ChangeLog-21.4.2.md
\ No newline at end of file

diff --git a/ChangeLogs/ChangeLog-21.4.2.md b/ChangeLogs/ChangeLog-21.4.2.md
new file mode 100644 (file)
index 0000000..e3a0927
--- /dev/null
+++ b/ChangeLogs/ChangeLog-21.4.2.md
@@ -0,0 +1,65 @@
+
+## Change Log for Release asterisk-21.4.2
+
+### Links:
+
+ - [Full ChangeLog](https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-21.4.2.md)  
+ - [GitHub Diff](https://github.com/asterisk/asterisk/compare/21.4.1...21.4.2)  
+ - [Tarball](https://downloads.asterisk.org/pub/telephony/asterisk/asterisk-21.4.2.tar.gz)  
+ - [Downloads](https://downloads.asterisk.org/pub/telephony/asterisk)  
+
+### Summary:
+
+- Commits: 1
+- Commit Authors: 1
+- Issues Resolved: 0
+- Security Advisories Resolved: 1
+  - [GHSA-c4cg-9275-6w44](https://github.com/asterisk/asterisk/security/advisories/GHSA-c4cg-9275-6w44): Write=originate, is sufficient permissions for code execution / System() dialplan
+
+### User Notes:
+
+
+### Upgrade Notes:
+
+
+### Commit Authors:
+
+- George Joseph: (1)
+
+## Issue and Commit Detail:
+
+### Closed Issues:
+
+  - !GHSA-c4cg-9275-6w44: Write=originate, is sufficient permissions for code execution / System() dialplan
+
+### Commits By Author:
+
+- #### George Joseph (1):
+  - manager.c: Add entries to Originate blacklist
+
+
+### Commit List:
+
+-  manager.c: Add entries to Originate blacklist
+
+### Commit Details:
+
+#### manager.c: Add entries to Originate blacklist
+  Author: George Joseph
+  Date:   2024-07-22
+
+  Added Reload and DBdeltree to the list of dialplan application that
+  can't be executed via the Originate manager action without also
+  having write SYSTEM permissions.
+
+  Added CURL, DB*, FILE, ODBC and REALTIME* to the list of dialplan
+  functions that can't be executed via the Originate manager action
+  without also having write SYSTEM permissions.
+
+  If the Queue application is attempted to be run by the Originate
+  manager action and an AGI parameter is specified in the app data,
+  it'll be rejected unless the manager user has either the AGI or
+  SYSTEM permissions.
+
+  Resolves: #GHSA-c4cg-9275-6w44
+