package/asterisk: security bump to version 16.30.1
PATCH 1/1 package/asterisk: security bump to version 16.30.1
Fixes the following security vulnerabilities:
CVE-2022-23537: Heap buffer overflow when decoding STUN message in pjproject
Possible buffer overread when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects Asterisk users using ICE and/or WebRTC.
https://github.com/asterisk/asterisk/security/advisories/GHSA-4xjp-22g4-9fxm
--- package/asterisk/asterisk.hash | 2 +- package/asterisk/asterisk.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
package/asterisk/asterisk.hash +1 -1
@@ -1,5 +1,5 @@ # Locally computed -sha256 9b93006a87be9c29492299118200e4f66c8369851c66a50fdef5b15dfc4eb2c2 asterisk-16.29.1.tar.gz +sha256 ef1ddc07dc02bb0c5f5ba58a5e42e42bcb63e55ac94199be8e3b5d3910f43736 asterisk-16.30.1.tar.gz # sha1 from: http://downloads.asterisk.org/pub/telephony/sounds/releases # sha256 locally computed
package/asterisk/asterisk.mk +1 -1
@@ -4,7 +4,7 @@ # ################################################################################ -ASTERISK_VERSION = 16.29.1 +ASTERISK_VERSION = 16.30.1 # Use the github mirror: it's an official mirror maintained by Digium, and # provides tarballs, which the main Asterisk git tree (behind Gerrit) does not. ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))
Signature · 6 lines
2.30.2 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Yann E. MORIN
AppliedPeter, All,
On 2023-09-17 11:02 +0200, Peter Korsgaard spake thusly:
Quoted 3 lines
Fixes the following security vulnerabilities:
CVE-2022-23537: Heap buffer overflow when decoding STUN message in pjproject
When I read "pjproject", I thnk "libpjsip". Is it realated? If so, is it impacted? If so, should we get a fix for it too?
Applied to master, thanks.
Regards,
Yann E. MORIN.
Quoted 43 lines
Possible buffer overread when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects Asterisk users using ICE and/or WebRTC.
https://github.com/asterisk/asterisk/security/advisories/GHSA-4xjp-22g4-9fxm
Signed-off-by Peter Korsgaard <[email protected]>--- package/asterisk/asterisk.hash | 2 +- package/asterisk/asterisk.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)package/asterisk/asterisk.hash +1
-1@@ -1,5 +1,5 @@ # Locally computed -sha256 9b93006a87be9c29492299118200e4f66c8369851c66a50fdef5b15dfc4eb2c2 asterisk-16.29.1.tar.gz +sha256 ef1ddc07dc02bb0c5f5ba58a5e42e42bcb63e55ac94199be8e3b5d3910f43736 asterisk-16.30.1.tar.gz # sha1 from: http://downloads.asterisk.org/pub/telephony/sounds/releases # sha256 locally computedpackage/asterisk/asterisk.mk +1
-1@@ -4,7 +4,7 @@ # ################################################################################ -ASTERISK_VERSION = 16.29.1 +ASTERISK_VERSION = 16.30.1 # Use the github mirror: it's an official mirror maintained by Digium, and # provides tarballs, which the main Asterisk git tree (behind Gerrit) does not. ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))Signature · 6 lines
2.30.2 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Signature · 10 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------' _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Quoted 10 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Yann" == Yann E MORIN <[email protected]> writes:
Peter, All,
On 2023-09-17 11:02 +0200, Peter Korsgaard spake thusly:Quoted 3 lines
Fixes the following security vulnerabilities:
CVE-2022-23537: Heap buffer overflow when decoding STUN message in pjproject
When I read "pjproject", I thnk "libpjsip". Is it realated? If so, is it impacted? If so, should we get a fix for it too?
Yes, good point - I'll send a patch:
https://github.com/pjsip/pjproject/releases/tag/2.13.1
Signature · 5 lines
Bye, Peter Korsgaard _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot