--- title: Contact Center - Patch Release Notes - Version 4.13.34 slug: contact-center/contact-center-patch-release-notes-version-41334 docTags: createdAt: 2025-10-24T10:17:15.936Z --- # Release Details **Release Date:** 5-June-2025 **Short description:** This release includes security fixes related to host header injection and validation, VLA API fixes, and resolves various bugs impacting API functionality, user state management, UI display, and agent call handling. # Highlights / Summary - **Security Fix (Host Header Injection):** Implemented validation for incoming request hosts against an allowed list configured in the `.ini` file. - **VLA API Fix:** Resolved an issue with the "Fetch Voicelog by CRT Object ID" API failing in scenarios with multiple call IDs. - **API Functionality:** Fixed issues with a real-time dashboard API and agent availability reporting in node flows. - **Agent State Management:** Addressed inconsistencies related to agents receiving calls on multiple extensions during fallback and duplicate agent ID displays in monitoring. - **UI Fix:** Resolved an issue where Supervisor UI showed duplicate agent IDs in live monitoring. # Build Versions The following table lists the updated component versions for this release. | Component | Build URL | | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | ameyo-server | **ameyo-server-4.13.592.20250603-R\_199682-linux-gtk.x86\_64.rpm**
| | ameyo-art | **ameyo-art-4.13.89.20250603-R\_199679-linux-gtk.x86\_64.rpm**
| | management-server | ameyo-management-server-3.15.128.20220819-R\_53820.x86\_64 | | management-UI | ameyo-management-server-ui-3.15.79.20220825-R\_54354.x86\_64 | | ameyo-asterisk | ameyo-asterisk13-100.0.123.20230202-R\_54429\_el7-linux-gtk.x86\_64.rpm
ameyo-asterisk13-100.0.122.20230201-R\_77845\_el8.x86\_64.rpm | | ameyo-asap | ameyo-asap-100.0.19.20210708-R\_53436-linux-gtk.x86\_64.rpm ****
ameyo-asap-100.0.31.20231212-R\_122778\_el8-linux-gtk.x86\_64.rpm | | ameyo-djinn | ameyo-djinn-100.0.411.20250115-R\_176400.x86\_64.rpm | | ameyo-codec | ameyo-codecs13-100.0.10.20180312-R\_37320.i386.rpm
ameyo-codecs16-3.10.1-20150917-linux-gtk.x86\_64.rpm | | ameyo-crm | ameyocrm-100.0.379.20240516-R\_54694.x86\_64.rpm | | JDK | java-1.8.0-amazon-corretto-devel-1.8.0\_312.b07-1.x86\_64.rpm | | CAF Google Play Store | caf\_googlePlay-100.0.37.20231011-R\_112974.x86\_64.rpm | | CAF Youtube | caf\_youtube-100.8.0.20230904-R\_54528.x86\_64.rpm | | UI Less Integration - Zoho Connector laravel build | zoho-connector-100.0.36.20230817-R\_104650.x86\_64.rpm | | UI Less Integration - Zoho User Management app | zoho\_CRM\_Connector-100.0.10-R\_54327.aaex | | WFM NICE Response Transformation App | NICE\_Connector\_App-100.0.13-R\_54375.aaex | | AMF for whatsapp, cogno and Instagram integration | AMF-100.0.239.20250327-R\_54787.x86\_64.rpm | | Voicelog Privilege App | Voice\_Log\_Privilege\_App-100.0.61-R\_54105.aaex | | Dial User App | Dial\_User\_App-100.0.31-R\_51344.aaex | | System Smart View App | Smart\_User\_App-100.0.94-R\_54159.aaex  | | PIck Call App | pick\_Call\_App-100.0.36-R\_51381.aaex | | Bulk Operation App | Bulk\_operation-100.0.48-R\_51285.aaex | | Desktop Notification App | NotificationApp-100.0.29-R\_52192.aaex | | Agent Signature App | Agent\_signature\_app-100.0.27-R\_51283.aaex | | Agent Self Monitoring App | Agent\_Self\_Monitoring-100.1.98-R\_51265.aaex | | Redirection App | RedirectionApp-100.0.3-R\_51489.aaex | | Quota App | quota\_management\_app-100.0.74-R\_54362.aaex | | Skill Monitoring App | skill\_monitoring\_app-100.0.14-R\_54167.aaex | | Routing Test App | RoutingTest-100.0.1-R\_54180.aaex | | Debugger App | DebuggerApp-100.0.7-R\_54338.aaex | | ACP | acp-100.1.92.20231130-R\_120901.x86\_64.rpm | | amd | ameyo-amd16-100.0.31.20210521-R\_52916-linux-gtk.i386.rpm | | zabbix | ameyo-zabbix-100.0.127.20221115-R\_63336.el7.x86\_64.rpm
ameyo-zabbix-agent-100.0.54.20210617-R\_53204.x86\_64.rpm | | failover | ameyo-failover-100.0.29.20230504-R\_89111.x86\_64.rpm | | Video micro service | video-4.13.110.20240304-R\_133174.x86\_64.rpm | | Voice Agent mobile app | Android - Voice Agent App 5.7.5-R (Voice-Agent-5.7.4.20211011-release.apk)
Ios  -  Voice Agent App 3.3 | | Field Agent mobile app | Android - Field Agent App 5.4-R (ameyo.fieldagent.com-5.4.20230905-release.apk)
Ios - Field Agent App version 3.3 | | Supervisor mobile app | Android - Supervisor App : com.ameyo.supervisor-2.1.20210812-release.apk
Ios - moved to live on apple store | | grafana | grafana-7.1.4-1x86\_64.rpm | | SFDC Integration app | CRM\_Integration-100.0.8-R\_54454.aaex | :::hint{type="info"} *Note: Only components with significant changes are listed. Full build details are available in internal documentation.* ::: # Feature Enhancements - No new features introduced in this patch. Focus is on security and bug fixes. # Bug Fixes ## System Common Bugs - ***Real-time Dashboard API (SL-17050):*** Fixed an issue where a REST API intended for real-time logged-in user data failed when executed with a JWT token. - ***Agent Availability Node (SL-16896):*** Resolved an inconsistency where the Agent Availability Node reported incorrect statuses when used at the queue level compared to the campaign level. - ***Extension Fallback Issue (SL-17054):*** Fixed an issue where agents received calls simultaneously on WebRTC and dual-call-leg extensions during extension fallback, leading to erroneous states. - ***Supervisor Monitoring UI (SL-16973):*** Addressed an issue where Supervisor live monitoring randomly displayed duplicate agent IDs, particularly when `allowMultipleExtension` was false. ## VLA - ***Voicelog Download API (SL-17029):*** Corrected the "Fetch Voicelog by CRT Object ID" API to handle scenarios with multiple call IDs correctly, ensuring the proper recording is fetched even if entries without `recording_dacx_uri` exist. # Security and Performance Updates - ***Arbitrary Host Header Injection (GA-14877):*** - Earlier, the system did not validate the host specified in incoming requests, which allowed requests with any host value to pass through successfully. - **Update:** The system now validates the host in each request against a list of approved hosts. Administrators can define this list in the server’s `.ini `configuration file. ## Limitations / Known Issues - No new limitations identified in this patch. ## Browser and Platform Compatibility - **Supported Browsers:** Chrome Version 137.0.7151.56 (Official Build) (arm64) or later is recommended. - **Mobile Apps:** No updates in this patch. ## Hot Fixes Included (from previous versions if applicable) - ***Report Upload Security (GA-15080):*** Added regex validation and keyword filtering to the "Upload JRXML" field in reporting to prevent insecure file uploads (Included via Art build ameyo-art-4.13.90). ## Contact / Support Information For issues or queries, please contact Exotel contact center Support via the support portal or through designated email channels.