Debian Package Tracker

general

source: asterisk (main)
version: 1:16.12.0~dfsg-1
maintainer: Debian VoIP Team (archive) (DMD)
uploaders: Mark Purcell [DMD] – Bernhard Schmidt [DMD] – Tzafrir Cohen [DMD] – Jonas Smedegaard [DMD] – Jeremy Lainé [DMD]
arch: all any
std-ver: 4.1.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:11.13.1~dfsg-2+deb8u5
o-o-sec: 1:11.13.1~dfsg-2+deb8u8
oldstable: 1:13.14.1~dfsg-2+deb9u4
old-sec: 1:13.14.1~dfsg-2+deb9u4
stable: 1:16.2.1~dfsg-1+deb10u2
unstable: 1:16.12.0~dfsg-1

versioned links

1:11.13.1~dfsg-2+deb8u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:11.13.1~dfsg-2+deb8u8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:13.14.1~dfsg-2+deb9u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:16.2.1~dfsg-1+deb10u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:16.12.0~dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

asterisk (16 bugs: 0, 9, 7, 0)
asterisk-config (1 bugs: 0, 0, 1, 0)
asterisk-dahdi
asterisk-dev
asterisk-doc
asterisk-mobile
asterisk-modules
asterisk-mp3
asterisk-mysql
asterisk-ooh323
asterisk-tests
asterisk-voicemail
asterisk-voicemail-imapstorage
asterisk-voicemail-odbcstorage
asterisk-vpb

action needed

A new upstream version is available: 16.13.0 high

A new upstream version 16.13.0 is available, you should consider packaging it.

Created: 2020-09-05 Last update: 2020-10-19 22:05

lintian reports 3 warnings high

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2020-07-29 Last update: 2020-09-21 06:01

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 2-day delay is over. Check why.

Created: 2020-09-25 Last update: 2020-10-20 01:04

6 ignored security issues in stretch low

There are 6 open security issues in stretch.

6 issues skipped by the security teams:

CVE-2019-12827: Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.
CVE-2019-13161: An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).
CVE-2019-15297: res_pjsip_t38 in Sangoma Asterisk 13.21-cert4, 15.7.3, and 16.5.0 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk.
CVE-2019-18610: An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.
CVE-2019-18790: An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x, 16.x, and 17.x, and Certified Asterisk 13.21, because of an incomplete fix for CVE-2019-18351. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.
CVE-2019-18976: An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.

Please fix them.

Created: 2019-07-13 Last update: 2020-09-26 14:00

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2020-02-26 Last update: 2020-02-26 10:49

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2019-01-12 Last update: 2019-01-12 00:07

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.0 instead of 4.1.1).

Created: 2017-12-08 Last update: 2020-09-01 04:07

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status: Blocked. Can't migrate due to a non-migratable dependency. Check status below.
- Blocked by: libpri
- Migrates after: dahdi-tools, openr2
- Migration status for asterisk (- to 1:16.12.0~dfsg-1): BLOCKED: Cannot migrate due to another item, which is blocked (please check which dependencies are stuck)
- Issues preventing migration:
- Build-Depends(-Arch): asterisk libpri (not considered)
- Depends: asterisk libpri (not considered)
- Invalidated by build-dependency
- Invalidated by dependency
- Build-Depends(-Arch): asterisk dahdi-tools
- Build-Depends(-Arch): asterisk openr2
- Depends: asterisk dahdi-tools
- Depends: asterisk openr2
- Additional info:
- Piuparts tested OK - https://piuparts.debian.org/sid/source/a/asterisk.html
- Required age reduced by 3 days because of autopkgtest
- 49 days old (needed 2 days)
- Not considered

news

[rss feed]

[2020-09-26] asterisk REMOVED from testing (Debian testing watch)
[2020-09-05] Accepted asterisk 1:16.2.1~dfsg-1+deb10u2 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Bernhard Schmidt)
[2020-09-03] asterisk 1:16.12.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2020-08-31] Accepted asterisk 1:16.12.0~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2020-05-23] asterisk 1:16.10.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2020-05-20] Accepted asterisk 1:16.10.0~dfsg-1 (source) into unstable (Lucas Kanashiro)
[2019-12-01] Accepted asterisk 1:11.13.1~dfsg-2+deb8u8 (source i386 all) into oldoldstable (Adrian Bunk)
[2019-11-30] Accepted asterisk 1:11.13.1~dfsg-2+deb8u7 (source i386 all) into oldoldstable (Adrian Bunk)
[2019-08-21] Accepted asterisk 1:16.2.1~dfsg-1+deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Bernhard Schmidt)
[2019-07-16] asterisk 1:16.2.1~dfsg-2 MIGRATED to testing (Debian testing watch)
[2019-07-13] Accepted asterisk 1:16.2.1~dfsg-2 (source) into unstable (Bernhard Schmidt)
[2019-03-15] asterisk 1:16.2.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-03-07] Accepted asterisk 1:16.2.1~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2019-03-03] asterisk 1:16.2.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-02-20] Accepted asterisk 1:16.2.0~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2019-01-14] asterisk 1:16.1.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-01-11] Accepted asterisk 1:16.1.1~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2019-01-07] asterisk 1:13.23.1~dfsg-2 MIGRATED to testing (Debian testing watch)
[2019-01-04] Accepted asterisk 1:16.1.0~dfsg-4 (source) into experimental (Bernhard Schmidt)
[2019-01-03] Accepted asterisk 1:13.23.1~dfsg-2 (source) into unstable (Bernhard Schmidt)
[2018-12-22] Accepted asterisk 1:16.1.0~dfsg-3 (source) into experimental (Bernhard Schmidt)
[2018-12-21] Accepted asterisk 1:16.1.0~dfsg-2 (source) into experimental (Bernhard Schmidt)
[2018-12-19] Accepted asterisk 1:16.1.0~dfsg-1 (source) into experimental (Bernhard Schmidt)
[2018-11-14] asterisk 1:13.23.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2018-10-20] Accepted asterisk 1:13.14.1~dfsg-2+deb9u4 (source) into proposed-updates->stable-new, proposed-updates (Bernhard Schmidt)
[2018-10-16] Accepted asterisk 1:13.14.1~dfsg-2+deb9u4 (source) into stable->embargoed, stable (Bernhard Schmidt)
[2018-09-27] Accepted asterisk 1:11.13.1~dfsg-2+deb8u6 (source amd64 all) into oldstable (Markus Koschany)
[2018-09-25] Accepted asterisk 1:13.23.1~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2018-09-08] asterisk 1:13.22.0~dfsg-2 MIGRATED to testing (Debian testing watch)
[2018-09-05] Accepted asterisk 1:13.22.0~dfsg-2 (source) into unstable (Bernhard Schmidt)

bugs [bug history graph]

all: 20
RC: 0
I&N: 11
M&W: 9
F&P: 0
patch: 0

links

homepage
lintian (0, 3)
buildd: logs, checks, clang, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
l10n (-, 98)
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:16.12.0~dfsg-1
17 bugs