asterisk: security bump to version 14.7.5
PATCH 1/1 asterisk: security bump to version 14.7.5
Fixes the following security issues:
* AST-2017-014: Crash in PJSIP resource when missing a contact header A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and using the PJSIP channel driver, it would cause Asterisk to crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled a user would have to first be authorized before reaching the crash point.
For more details, see the announcement:
https://www.asterisk.org/downloads/asterisk-news/asterisk-13185-1475-1515-and-1318-cert2-now-available-security
--- package/asterisk/asterisk.hash | 2 +- package/asterisk/asterisk.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
package/asterisk/asterisk.hash +1 -1
@@ -1,5 +1,5 @@ # Locally computed -sha256 f85f6df802de485d9b8cb1bfa5493e22f6401dce8246646af9506489a264d7b1 asterisk-14.6.2.tar.gz +sha256 6525170fa16fecb08cb3cde2c1bd5d3140df55b14e4561ac0771fbd1e04b3b75 asterisk-14.7.5.tar.gz # sha1 from: http://downloads.asterisk.org/pub/telephony/sounds/releases # sha256 locally computed
package/asterisk/asterisk.mk +1 -1
@@ -4,7 +4,7 @@ # ################################################################################ -ASTERISK_VERSION = 14.6.2 +ASTERISK_VERSION = 14.7.5 # Use the github mirror: it's an official mirror maintained by Digium, and # provides tarballs, which the main Asterisk git tree (behind Gerrit) does not. ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))
Signature · 1 line
2.11.0
Thomas Petazzoni
AppliedPATCH 1/1 asterisk: security bump to version 14.7.5
Hello,
Quoted 10 lines · Peter Korsgaard
Fixes the following security issues:
* AST-2017-014: Crash in PJSIP resource when missing a contact header A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and using the PJSIP channel driver, it would cause Asterisk to crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled a user would have to first be authorized before reaching the crash point.
Quoted 8 lines
For more details, see the announcement:
https://www.asterisk.org/downloads/asterisk-news/asterisk-13185-1475-1515-and-1318-cert2-now-available-securitySigned-off-by Peter Korsgaard <[email protected]>--- package/asterisk/asterisk.hash | 2 +- package/asterisk/asterisk.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
Applied to master, thanks.
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
PATCH 1/1 asterisk: security bump to version 14.7.5
In reply to Peter KorsgaardQuoted 11 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Peter" == Peter Korsgaard <[email protected]> writes:
Fixes the following security issues:
* AST-2017-014: Crash in PJSIP resource when missing a contact header A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and using the PJSIP channel driver, it would cause Asterisk to crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled a user would have to first be authorized before reaching the crash point.
Quoted 4 lines
For more details, see the announcement:
https://www.asterisk.org/downloads/asterisk-news/asterisk-13185-1475-1515-and-1318-cert2-now-available-securitySigned-off-by Peter Korsgaard <[email protected]>
Committed to 2017.11.x, thanks.
Signature · 1 line
Bye, Peter Korsgaard