CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

net/asterisk20 20.21.0

Open Source PBX and telephony toolkit

Port info

Maintainer
o.kryvulia@flex-it.com.ua
Packages
latest: 20.21.0
Upstream
up to date
Last update
to 20.21.0 · a2bad65a40
Quarterly
2026Q4: 20.21.0
WWW
https://www.asterisk.org
Links
cgit · VuXML

Install

Package
# pkg install asterisk20
installs 20.21.0 from latest; from quarterly (2026Q4) 20.21.0
Port
# cd /usr/ports/net/asterisk20 && make install clean
# make -C /usr/ports/net/asterisk20 config  # change options first
Size
22 MiB download · 42 MiB installed
Depends on
archivers/zstd 1.5.7_2, audio/gsm 1.0.24, audio/libogg 1.3.6,4, audio/libvorbis 1.3.7_2,3, audio/mpg123 1.33.7, audio/opus 1.6.1, audio/portaudio 19.6.0_8,1, audio/speex 1.2.1_1,1, audio/speexdsp 1.2.1, comms/spandsp 3.0.0.g20211014_2, databases/freetds 1.5.19,1, databases/mysql84-client 8.4.11_1, databases/postgresql18-client 18.6, databases/sqlite3 3.53.4,1, databases/unixODBC 2.3.12_2, devel/jansson 2.15.1_1, devel/libedit 3.1.20260512,1, devel/libltdl 2.6.2, devel/libunwind 20250904, devel/newt 0.52.25, ftp/curl 8.23.0, graphics/tiff 4.7.2, lang/lua54 5.4.8, misc/dahdi 2.4.0rc5_8, misc/libpri 1.6.1, misc/libuuid 2.42.4, misc/openr2 1.3.3_1, net-mgmt/net-snmp 5.9.5.2,1, net/libsrtp2 2.8.1, net/radiusclient 0.5.6_3, net/uriparser 1.0.2, ports-mgmt/pkg 2.8.4, security/gnutls 3.8.13, textproc/iksemel 1.5, textproc/libxml2 2.15.4
License
GPLv2
Creates
user asterisk, group asterisk, dahdi
Options
23 of 36 on in the package: CURL DAHDI FREETDS GSM LUA MACRO MP3PLAYER MYSQL NEWT ODBC OPUS PGSQL PJSIP PORTAUDIO RADIUS SNMP SPANDSP SPEEX SRTP URIPARSER VORBIS XMLDOC XMPP
Show the 13 options that are off
ASTVERSION BACKTRACE EXCHANGE G729 GEOLOCATION LDAP NCURSES NEWG711 OOH323 OPTIMIZED_CFLAGS SIP SYSINFO UNBOUND
pkg-message
Shown after installing
This port supports custom Asterisk configurations using a *user-supplied*
  menuselect.makeopt file.

  This feature is of most value for users that want to disable or override
  default functionality that they dont want or need, particular in space
  and/or resource constrained, or embedded environments.

  If a file named ".asterisk.makeopts" is found in the ports files/
  directory, its contents will be used to configure Asterisk at the
  post-configure stage.

  If the file is *not* found, the port will default to a 'normal' Asterisk
  menuselect configuration, and only execute menuselect commands according
  to what port OPTIONS the user has selected.

  The format of this file is the same as the output of a standard
  `make menuselect` command, as per standard build instructions for
  Asterisk.

  NOTE: The contents of this file *MUST* be syntactically and semantically
        valid, as the port does *NOT* perform validation of this file.

        In particular, ensure that all Asterisk options have their
        dependencies met, using the corresponding port OPTIONS dependencies.

  The `menuselect --check-deps` command can be used to verify the
  configuration

  The following related documentation resources are also available:

    * https://wiki.asterisk.org/wiki/display/AST/Using+Menuselect+to+Select+Asterisk+Options
    * http://www.asteriskdocs.org/en/3rd_Edition/asterisk-book-html-chunk/installing_base_configuration.html#Installing_id293213

  NOTE: To get color output in the asterisk console you need to install
        the misc/terminfo-db port

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 1620.21.020.21.0–
FreeBSD 1520.21.020.21.0–
FreeBSD 1420.21.020.21.0✗

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 1520.21.020.21.0–
FreeBSD 1420.21.020.21.0✗

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 20.21.0.

Fixed (1)

Show 1 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (1) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
294816maintainer-feedback? net/asterisk20 net/asterisk22 --- feature - add usecallmanagerNew2026-04-30

Commits (25)

Yusuf Yaman (nxjoseph) · 20.21.0 MFH 2026Q3 ✓
net/asterisk{20,22}: Fix build with WITH_PIE

Upstream commit f82393d brokes build options handling for
bundled pjproject. That was fixed later by 78b7c4e.
Temporary use this patch in our ports until next release.

PR:		298207
Co-authored-by:	Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
Sponsored by:	FLEX-IT LLC
MFH:		2026Q3
a2bad65a40
Yusuf Yaman (nxjoseph) · 20.21.0 MFH 2026Q3 ✓
net/asterisk20: Update 20.20.1 => 20.21.0

Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.21.0.html

PR:		298203
Reported by:	Oleksandr Kryvulia <o.kryvulia@flex-it.com.ua> (maintainer)
Approved by:	osa, vvd (Mentors, implicit)
Sponsored by: 	FLEX-IT LLC
MFH:		2026Q3
a1c4b69761
Vladimir Druzenko (vvd) · 20.20.1
net/asterisk20: Update 20.19.0 => 20.20.1

Changelogs:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.20.0.html
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.20.1.html

PR:		296366
Security:	GHSA-3g56-cgrh-95p5
Security:	GHSA-3rhj-hhw7-m6fw
Security:	GHSA-4pgv-j3mr-3rcp
Security:	GHSA-589g-qgf8-m6mx
Security:	GHSA-746q-794h-cc7f
Security:	GHSA-8jhw-m2hg-vp3h
Security:	GHSA-8jw3-ccr9-xrmf
Security:	GHSA-g8q2-p36q-94f6
Security:	GHSA-j2mm-57pq-jh94
Security:	GHSA-mxgm-8c6f-5p8f
Security:	GHSA-ph27-3m5q-mj5m
Security:	GHSA-q9fr-m7g8-6ph5
Security:	GHSA-qf8j-jp7h-c5hx
Security:	GHSA-r6c2-hwc2-j4mp
Security:	GHSA-vfhr-r9x9-c687
Security:	GHSA-vrfp-mg3q-3959
Security:	GHSA-wcvv-g26m-wx5c
Security:	GHSA-x348-j6c9-77f3
Security:	GHSA-xgj6-2gc5-5x9c
Sponsored by:	FLEX-IT LLC
Sponsored by:	UNIS Labs
MFH:		2026Q2
b61744b734
Rene Ladan (rene) · 20.19.0
all: drop support for FreeBSD 13, mips and risc64sf

Reviewed by:            many (*)
Differential Revision:  https://reviews.freebsd.org/D55624
Differential Revision:  https://reviews.freebsd.org/D55642 (merged in from bofh)

many (*)
  acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
  jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
  nobutaka pkubaj se tagattie thj

  Anton Saietskii
  GenericRikka
  Gert Doering
  Jan Bramkamp
  Oleh Hushchenkov
  Oleksandr Kryvulia
  Ralf van der Enden
  Yamagi

  desktop kde python tcltk office
2a7c056120
Vladimir Druzenko (vvd) · 20.19.0
net/asterisk20: Update 20.18.2 → 20.19.0

Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.19.0.html

PR:		294411
Sponsored by:	FLEX-IT LLC
Sponsored by:	UNIS Labs
a02bd2eb52
Vladimir Druzenko (vvd) · 20.18.2_1
net/asterisk20: Add MP3 Decoder Code for Format_MP3 support

Format_MP3, used to play MP3 encoded voicemail and music on hold, relies
on decoder library files that are not included in the main Asterisk
distribution.

PR:		292715
Tested by:	Marek Zarychta <zarychtam@plan-b.pwste.edu.pl>
Approved by:	Oleksandr Kryvulia <o.kryvulia@flex-it.com.ua>
Co-authored-by:	Justin T. Gibbs <gibbs@FreeBSD.org>
3ac123c705
Vladimir Druzenko (vvd) · 20.18.2
net/asterisk22: Update 20.18.1 => 20.18.2

Security Advisories Resolved: 4
- GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT
  leading to potential XXE Injection.
- GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources
  ast_debug_tools.conf from /etc/asterisk; potentially leading to
  privilege escalation.
- GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus
  page echos user supplied values(cookie and query string) without
  sanitization.
- GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init
  file to world writeable folder; leading to potential privilege
  escalation.

Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/old-releases/ChangeLog-20.18.2.html

PR:		293361
Approved by:	Oleksandr Kryvulia <o.kryvulia@flex-it.com.ua>
Security:	GHSA-85x7-54wr-vh42
Security:	GHSA-rvch-3jmx-3jf3
Security:	GHSA-v6hp-wh3r-cwxh
Security:	GHSA-xpc6-x892-v83c
MFH:		2026Q1
ab05146a6f
Vladimir Druzenko (vvd) · 20.18.1
net/asterisk20: Update 20.17.0 => 20.18.1

Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/old-releases/ChangeLog-20.18.0.html
https://downloads.asterisk.org/pub/telephony/asterisk/old-releases/ChangeLog-20.18.1.html

This update incorporates an important fix for FreeBSD users:
- rtp/rtcp: Configure dual-stack behavior via IPV6_V6ONLY

PR:		262386 292768
Approved by:	Oleksandr Kryvulia <o.kryvulia@flex-it.com.ua> (maintainer)
Sponsored by:	PANS Jarosław
MFH:		2026Q1
46e972ab19
Vladimir Druzenko (vvd) · 20.17.0
net/asterisk22: Update 20.16.0 → 20.17.0

Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.17.0.html

Add non-default option UNBOUND to prevent silent grab of libunbound.so
from dns/unbound.

PR:		291176
Sponsored by:	FLEX-IT LLC
Co-authored-by:	Vladimir Druzenko <vvd@FreeBSD.org>
e98c3e93db
Vladimir Druzenko (vvd) · 20.16.0_1
net/asterisk20: Fix Endianness detection

After update to 20.16.0 and 22.6.0 Asterisk misbehaves, see
https://github.com/asterisk/asterisk/issues/1536
The patch submitted in https://github.com/asterisk/asterisk/pull/1541
fixes that.

PR:		290317 290318
Reported by:	Oleksandr Kryvulia <o.kryvulia@flex-it.com.ua> (maintainer)
349bb45906
Vladimir Druzenko (vvd) · 20.16.0
net/asterisk20: Update 20.15.2 → 20.16.0

Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.16.0.html

PR:		290317
Sponsored by:	FLEX-IT LLC
f898c571a9
Vladimir Druzenko (vvd) · 20.15.2
net/asterisk20: Update 20.15.1 => 20.15.2 (security fix)

Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.15.2.html

GHSA-64qc-9x89-rx5j: A specifically malformed Authorization header in
an incoming SIP request can cause Asterisk to crash.

PR:		289180
Security:	GHSA-64qc-9x89-rx5j
Sponsored by:	FLEX-IT LLC
MFH:		2025Q3
ffcdceaf3b
Älven (alven) · 20.15.1
net/asterisk20: Update 20.15.0 => 20.15.1 (security fix)

Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.15.1.html

Security:	GHSA-mrq5-74j5-f5cr
Security:	GHSA-v9q8-9j8m-5xwp
Sponsored by:	FLEX-IT LLC

PR:		288615
Approved by:	yuri@ (Mentor)

MFH:	 	2025Q3
d63aab956a
Piotr Kubaj (pkubaj) · 20.15.0
net/asterisk{18,20,22}: allow GEOLOCATION on powerpc*
a7f4260710
Vladimir Druzenko (vvd) · 20.15.0
net/asterisk20: Update 20.14.1 → 20.15.0 (security fix)

GHSA-c7p6-7mvq-8jq2: cli_permissions.conf: deny option does not work
for disallowing shell commands

Change Log:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.15.0.html

PR:		288429
Security:	GHSA-c7p6-7mvq-8jq2
Sponsored by:	FLEX-IT LLC
MFH:		2025Q3
95ebee717d
Matthias Andree (mandree) · 20.14.1_1
*/*: Switch to misc/libuuid and misc/libblkid

PR:		221293
PR:		251489
PR:		257070
e81eda36a8
Baptiste Daroussin (bapt) · 20.14.1_1
libxml2: chase libxml soversion bump
3068854dd0
Vladimir Druzenko (vvd) · 20.14.1
net/asterisk20: Update 20.14.0 → 20.14.1 (fix security issues)

Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.14.1.html

PR:		287016
Security:	GHSA-2grh-7mhv-fcfw
Security:	GHSA-c7p6-7mvq-8jq2
MFH:		2025Q2
c0048e8764
Vladimir Druzenko (vvd) · 20.14.0
net/asterisk20: Update 20.13.0 → 20.14.0

ChangeLog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.14.0.html

Fix loading pjsip modules on CURRENT

PR:		286760
Sponsored by:	FLEX-IT LLC
MFH:		2025Q2
ef8b51a53d
Vladimir Druzenko (vvd) · 20.13.0
net/asterisk20: Update 20.12.0 → 20.13.0

ChangeLog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-20.13.0.html

PR:		285735
Sponsored by:	FLEX-IT LLC
64a4187257
Joel Bodenmann (jbo) · 20.12.0
net/asterisk20: Update 20.11.1 → 20.12.0

Changelog: https://www.asterisk.org/asterisk-news/asterisk-20-12-0-now-available

PR:		284705
Sponsored by:	FLEX-IT LLC
4c397b866b
Piotr Kubaj (pkubaj) · 20.11.1
net/asterisk20: allow GEOLOCATION on powerpc64le
5b43274b35
Vladimir Druzenko (vvd) · 20.11.1
net/asterisk20: Update 20.11.0 → 20.11.1 (security fix GHSA-33x6-fj46-6rfh)

News:
https://www.asterisk.org/asterisk-news/asterisk-security-release-20-11-1-now-available/

Security fix GHSA-33x6-fj46-6rfh:
- Path traversal via AMI ListCategories allows access to outside files
https://github.com/asterisk/asterisk/security/advisories/GHSA-33x6-fj46-6rfh

PR:		283975
Sponsored by:	FLEX-IT LLC
MFH:		2025Q1
138365b72f
Vladimir Druzenko (vvd) · 20.11.0_1
net/asterisk20: Fix build with G729 option

Also update asterisk-core-sounds-en-g729 from 1.5 to 1.6.

PR:	283417
Fixes:	b85572488263 (Add net/asterisk20: LTS version of Asterisk PBX software)
285b017f80
Li-Wen Hsu (lwhsu) · 20.11.0
Add net/asterisk20: LTS version of Asterisk PBX software

PR:		280905
b855724882