Skip to content

FreeSWITCH v1.11.2 Release

Latest
Latest

Choose a tag to compare

View all tags
@andywolk andywolk released this 09 Aug 18:05
· 1 commit to master since this release
v1.11.2
3f13ad1

This is an important release containing extensive security hardening across the core, mod_rtmp, mod_xml_rpc and mod_sofia, alongside the new interface allowlist, stricter DTLS/STUN validation for media sessions, and a modernized build system. We strongly encourage all users to upgrade to v1.11.2 as soon as possible.

 Release Notes - FreeSWITCH - Version 1.11.2

Enhancement

  • [Build-system] Migrate music/sounds from files.freeswitch.org to https://github.com/freeswitch/freeswitch-sounds/releases
  • [Build-System] Update gawk to 3.1.8 on Windows.
  • [Build-System] Update SQLite to 3.53.3 on Windows.
  • [Build-System] Windows: Download 7z and icsharpcode/SharpZipLib from GitHub instead of files.freeswitch.org during the build.
  • [Build-System] Wix: Show progress when signing modules on Windows.
  • [Core, mod_commands] Interface allowlist
  • [core] Verify DTLS client cert against SDP fingerprint (server role)
  • [libvpx] Update to v1.12.0
  • [libvpx] Windows: Use NASM instead of Yasm
  • [mod_av] Use pre-compiled FFmpeg 7.1.5 binary on Windows
  • [mod_codec2] Use pre-compiled libcodec2 package on Windows.
  • [mod_v8] Use pre-compiled libnode 20.19.2 binary instead of custom v8-6.1 lib on Windows.
  • [mod_v8] Use upstream libnode-dev instead of custom libv8-6.1-dev on Linux. Enable for ARM64 and armhf.
  • [mod_v8_skel] Use libnode instead of libv8 on Windows.
  • [SpanDSP] Update to v3.1.1 and fix build on Windows.
  • Bump sofia-sip library requirement to version 1.13.18

Bug

  • [core] Bound and isolate the SDP crypto keysalt before decoding
  • [core] Bound RTCP NACK feedback loop to validated length.
  • [core] Fix heap OOB read in switch_event_expand_headers_check() for ${var:offset} slicing.
  • [core] Fix heap overflow in switch_xml_decode() for empty entity replacements.
  • [core] Fix XML escape encoder overrun and unsigned-char UTF-8 gate
  • [core] Guard MSRP range-star body length against underflow
  • [core] Harden STUN attribute parsing bounds and USERNAME copy
  • [core] Harden switch_b64_decode output bound and input handling
  • [Core] switch_sockaddr_info_get() will not resolve if the hostname is an IP address. Add new switch_is_ip_address() API. Add a unit-test.
  • [core] Validate IPv6 XOR-MAPPED-ADDRESS length in STUN parser
  • [core] Verify STUN MESSAGE-INTEGRITY on inbound ICE checks (opt-in)
  • [GHA] Add source tarball generation workflow
  • [GHA] Fix macos workflow.
  • [mod_amqp] prevent segfault on double connection close
  • [mod_event_socket] Bound Content-Length and free partial event on failure.
  • [mod_lua] Fix build on MacOS
  • [mod_lua] Move SWIG wrapper patches into ".i" typemaps, drop hack.diff
  • [mod_rtmp] Bound H.264 parameter-set and NAL-unit parsing against the payload
  • [mod_rtmp] Bound H264 STAP-A and AVC sequence header writes
  • [mod_rtmp] Bound USERCTRL control-message hex dump to its buffer
  • [mod_rtmp] Guard AMF invoke arguments against wrong-type reads
  • [mod_rtmp] Guard FU-A and short frames in rtmp_rtp2rtmpH264
  • [mod_rtmp] Harden H.264 video read path bounds and length parsing
  • [mod_silk] Bound decode loop to the codec's frame limit
  • [mod_sofia] Bound Contact display-name copy in dialog-probe callback
  • [mod_sofia] Fix broken sip: prefix check in deflect handler
  • [mod_sofia] Fix possible buffer overflow in sofia_dialog_probe_callback().
  • [mod_sofia] Pass REFER nightmare-transfer URI params through originate ovars
  • [mod_spandsp] Bound UDPTL FEC entry count and secondary length
  • [mod_xml_rpc] Bound HTTP directory-auth base64 to its output buffer
  • [mod_xml_rpc] Fix 64-bit WebSocket frame length handling
  • [mod_xml_rpc] Fix heap OOB writes in WebSocket frame parser.
  • [mod_xml_rpc] Fix OOB write and read-loop hang in WebSocket parser
  • [unit-tests] Bind the DTLS certificate test on the configured RTP port
Assets 3
Loading