I have just released GNU Gatekeeper version 5.17. This is a security
update and you are urged to please update as soon as possible.
Download from https://www.gnugk.org/h323download.html
This release contains about 90 bug fixes, most of them found by
Anthropics OSS-Scanner. Almost all of the bugs are security related,
some critical. There is also an important bug fix for H.460.18 between
neighbors.
Additionally, you should disable unused features in GnuGk to reduce
your attack surface. For example, only enable H.460.17, H.460.23,
H.460.24 and H.460.26 or T.120 if you really use them (which 99% of
users don't).
To help avoid regressions with this large number of fixes, a test
harness has been added to test some common call scenarios, but i
certainly doesn't cover all functionality, so please make sure you do
at least a quick test of the functionality you use after upgrading.
See the full list of changes below.
Regards,
Jan
Changes from 5.16 to 5.17
=========================
- BUGFIX(SoftPBX.cxx) set release source and cause for calls
disconnected by status port commands
- BUGFIX(ProxyChannel.cxx) fix callSignallingAddress in H.460.18 SCI to
traversal client neighbor
- BUGFIX(ProxyChannel.cxx) fix memory leak in call rerouting
- BUGFIX(GkStatus.cxx) limit status port command lines to 2K
- BUGFIX(gksql_redis.cxx) implement GkRedisResult::FetchRow(),report
Redis error replies as query errors
- BUGFIX(GkClient.*) add mutex for aliases
- BUGFIX(GkStatus.cxx) add mutex for libssh sessions
- BUGFIX(gkacct.cxx, gkauth.cxx) fix crash when reloading the config
- BUGFIX(ProxyChannel.cxx) fix race with H.235.6 encryption
- BUGFIX(ProxyChannel.cxx,RasSrv.cxx) fix H.460.17 memory leak
- BUGFIX(*) URL-escaping for HttpAcct, HttpPasswordAuth and HtttRouting
- BUGFIX(GkClient.cxx) check size of H.460.24 probe before reading it
- BUGFIX(ProxyChannel.cxx) better check for H.235.6 key size
- BUGFIX(RasTbl.cxx) fix crash in H.460.9 processing
- BUGFIX(ProxyChannel.cxx) fix socket leak in H.245 multiplexing
- BUGFIX(Routing.cxx) check field types in JSON response of Http policy
- BUGFIX(gksql_*.cxx) fix quoting of SQL commands
- BUGFIX(gksql_*.cxx) fix memory leaks
- BUGFIX(ProxyChannel.cxx, RasTbl.cxx) fix crash for endpoints using
old GnuGk NAT method
- BUGFIX(ProxyChannel.cxx) never select on or read from a signalling
socket that is marked deletable
- BUGFIX(ProxyChannel.cxx) avoid port exhaustion by checking error code
- BUGFIX(ProxyChannel.cxx) remove incorrect check that prevented
CallProceedings from being processed before forwarding
- BUGFIX(ProxyChannel.cxx) never open an H.245 connection to our own
status port
- BUGFIX(*) apply DisabledCodecs= switch to fastStart, too, fix setting
them with Radius
- new switch [RoutedMode] EnableT120=0 to remove T.120 capabilities and
reject T.120 channels (default is 1)
- config check: warn when SimplePasswordAuth tries to check messages an
enabled authenticator (CAT, MD5) never puts a token into
- BUGFIX(ProxyChannel.cxx) fix IPv4-IPv6 conversion bug when not
compiled with LARGE_FDSET
- new GnuGk test harness in test/
- BUGFIX(gkauth.cxx) fix AND (&) in AliasAuth/SQLAliasAuth rules
- BUGFIX(gkauth.cxx) match sigaddr rules in AliasAuth/SQLAliasAuth as
documented in manual
- BUGFIX(ProxyChannel.cxx) ignore H.460.19 RTCP keepAlives when
collecting RTCP statistics
- BUGFIX(amqpacct.cxx) serialize MQLog() with a mutex
- BUGFIX(ProxyChannel.cxx) check RTCP SDES item length against packet
size
- BUGFIX(Toolkit.cxx) keep temporary config files in private directory
(mkdtemp) instead of directly in /tmp
- BUGFIX(radproto.cxx) don't abort pending RADIUS request on an empty
datagram
- BUGFIX(ProxyChannel.cxx) fix NULL deref handling Sorensen source-info
- BUGFIX(ProxyChannel.cxx) better check for H.245 connection when doing
TCS0 transfer
- BUGFIX(Toolkit.cxx) null sql connections to avoid double-delete
- BUGFIX(RasTbl.cxx) lock gateway record while matching prefixes
- BUGFIX(ProxyChannel.cxx) fix double-delete in call failover
- BUGFIX(geoip.cxx) IPs without a database record are now country
'unknown' instead of an empty string
- BUGFIX(h460presence.cxx) fix crash with too long lists
- BUGFIX(h460presence.cxx) fix crash on empty subscription list
- BUGFIX(gksql_firebird.cxx) fix fetching INTs and row count in
Firebird SQL driver
- BUGFIX(forwarding.cxx) forwarding policy should only look at the
number of DB results it could actually fetch
- BUGFIX(yasocket.cxx) bind UDP socket exclusive, so other calls can
detect it is in use
- BUGFIX(RasTbl.*) lock CallRec in more setters and getters
- BUGFIX(RasSrv.cxx) better check for existing aliases on additive
registrations
- BUGFIX(ProxyChannel.cxx) RTP/RTCP proxy sockets hold own call
reference to avoid use-after-free on call cleanup
- BUGFIX(ProxyChannel.cxx) fix crash in call rerouting
- BUGFIX(sigmsg.cxx) check IE size before encoding
- BUGFIX(ProxyChannel.cxx) make sure the saved H.460.18 message is
really a Setup
- BUGFIX(ProxyChannel.cxx) fix crash in H.460.17 endpoint cleanup
- BUGFIX(Routing.cxx) add NULL check in vqueue policy
- BUGFIX(Routing.cxx) make sure we don't skip an alias when DNS policy
deletes one
- BUGFIX(RasSrv.cxx) avoid crash when dns policy removes all
destination aliases from ARQ
- BUGFIX(*) remove insecure support for neighbor access tokens, not
used since GnuGk 2.2
- BUGFIX(*) check ASN.1 array size when adding
- BUGFIX(RasTbl.*) protect access to keep-alive maps with a mutex
- BUGFIX(gkh235.cxx, gkauth.*) fix auth bypass with unknown token OIDs
- BUGFIX(ProxyChannel.cxx) don't crash on H.460.19 OLC without
mediaControlChannel
- BUGFIX(ldap.cxx, gkauth.cxx, Toolkit.cxx) escape LDAP filter
characters in aliases for LDAP and H.350 queries
- BUGFIX(ProxyChannel.cxx) reject Setup with a guessed CRV
- BUGFIX(ProxyChannel.cxx, gkauth.cxx) fix type confusion: index into
array not the array pointer
- BUGFIX(capctrl.*) CapacityControl must consider the CompareAliasCase=
setting
- BUGFIX(ProxyChannel.cxx) fix cleanup of H.460.19 fastStart channels
- BUGFIX(ProxyChannel.cxx) when accepting H.460.18 traversal clients,
make sure not to re-assign sockets
- BUGFIX(ProxyChannel.cxx) fix handling of H.460.18 Facility messages
- BUGFIX(ProxyChannel.cxx) fix race condition when opening a T.120
channel
- BUGFIX(ProxyChannel.cxx) use dynamic_cast in order not to confuse
T120LogicalChannel with RTPLogicalChannel causing crashes
- BUGFIX(RasTbl.cxx) fix crash on too long language list
- BUGFIX(RasSrv.cxx) only accept QoS reports from registered endpoints
(H.460.9)
- BUGFIX(authenticators.cxx) OpenSSL 3 fix for DES-ECB
- BUGFIX(ProxyChannel.cxx) block Connect or CallProceeding without a
call
- BUGFIX(gksql_odbc.cxx) detect if backend needs backslash escaping
- BUGFIX(gkauth.cxx, Routing.cxx, httpacct.cxx) only accept 2xx HTTP
responses as valid
- BUGFIX(ProxyChannel.*) use correct buffer size when acting as
encryption proxy
- BUGFIX(RasTbl.cxx) fix round robin routing (crash)
- BUGFIX(ProxyChannel.cxx) ignore fastStart channel after regular
channels have been established
- BUGFIX(*) safer H.460 parameter handling
- BUGFIX(ProxyChannel.cxx) drop impossibly large TPKT packets
- BUGFIX(RasTbl.*) add copy-ctors for H46019KeepAlive to fix
use-after-free
- BUGFIX(ProxyChannel.cxx) fix use-after-free in call cleanup
- BUGFIX(RasSrv.cxx) fix use-after-free
- BUGFIX(gksql_redis.cxx, gksql_mysql.cxx) fix resource leak
- BUGFIX(gkh235.cxx, gkauth.cxx, lua.cxx) better guard against empty
passwords
- BUGFIX(Routing.cxx) never route calls to our own status port
Monday, November 9, 2026
GNU Gatekeeper 5.17 release (SECURITY UPDATE)
