Skip to contentSkip to conversation

package/asterisk: security bump to version 16.1.0

PATCH New Peter Korsgaard 2 participants 2 messages Dec 23, 2018 – Dec 26, 2018

lore
Share & tools
lore

Peter Korsgaard

author
#0 lore raw

PATCH 1/1 package/asterisk: security bump to version 16.1.0

Fixes the following security issues:

- ASTERISK-28127: Buffer overflow for DNS SRV/NAPTR records
https://issues.asterisk.org/jira/browse/ASTERISK-28127

- ASTERISK-28013: res_http_websocket: Crash when reading HTTP Upgrade requests
https://issues.asterisk.org/jira/browse/ASTERISK-28013

For more details, see the announcement:
https://www.asterisk.org/downloads/asterisk-news/asterisk-1610-now-available

Asterisk now also contains m4 code needed to autoreconf under third-party/jansson, so add that to _AUTORECONF_OPTS.

Signed-off-by Peter Korsgaard <[email protected]>
---
 package/asterisk/asterisk.hash | 2 +-
 package/asterisk/asterisk.mk   | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)
package/asterisk/asterisk.hash +1 -1
index 4b3a087ec5..557660f0cf 100644
@@ -1,5 +1,5 @@
 # Locally computed
-sha256  54f8b172fa41cb7d4450c12666a8f9716ed7ba7391c54d3467c64772f6399d67  asterisk-16.0.0.tar.gz
+sha256  97e1bae8e9034cb2a8bc0d4d5bcc9dee4ffe4c6c57ed40b8825be79266fcac50  asterisk-16.1.0.tar.gz
 
 # sha1 from: http://downloads.asterisk.org/pub/telephony/sounds/releases
 # sha256 locally computed
package/asterisk/asterisk.mk +2 -2
index 8a46438f92..90f415647e 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-ASTERISK_VERSION = 16.0.0
+ASTERISK_VERSION = 16.1.0
 # Use the github mirror: it's an official mirror maintained by Digium, and
 # provides tarballs, which the main Asterisk git tree (behind Gerrit) does not.
 ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))

@@ -23,7 +23,7 @@ ASTERISK_LICENSE_FILES = \
 
 # For patches 0002, 0003 and 0005
 ASTERISK_AUTORECONF = YES
-ASTERISK_AUTORECONF_OPTS = -Iautoconf -Ithird-party -Ithird-party/pjproject
+ASTERISK_AUTORECONF_OPTS = -Iautoconf -Ithird-party -Ithird-party/pjproject -Ithird-party/jansson
 
 ASTERISK_DEPENDENCIES = \
 	host-asterisk \
Signature · 1 line
2.11.0
Applied
#1 lore raw

PATCH 1/1 package/asterisk: security bump to version 16.1.0

Hello,

Quoted 12 lines · Peter Korsgaard

Fixes the following security issues:

- ASTERISK-28127: Buffer overflow for DNS SRV/NAPTR records
https://issues.asterisk.org/jira/browse/ASTERISK-28127

- ASTERISK-28013: res_http_websocket: Crash when reading HTTP Upgrade requests
https://issues.asterisk.org/jira/browse/ASTERISK-28013

For more details, see the announcement:
https://www.asterisk.org/downloads/asterisk-news/asterisk-1610-now-available

Quoted 8 lines

Asterisk now also contains m4 code needed to autoreconf under third-party/jansson, so add that to _AUTORECONF_OPTS.

Signed-off-by Peter Korsgaard <[email protected]>
---
 package/asterisk/asterisk.hash | 2 +-
 package/asterisk/asterisk.mk   | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

Applied to master, thanks.

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com