Debian Package Tracker

general

source: asterisk (main)
version: 1:16.15.0~dfsg-1
maintainer: Debian VoIP Team (archive) (DMD)
uploaders: Jonas Smedegaard [DMD] – Tzafrir Cohen [DMD] – Mark Purcell [DMD] – Jeremy Lainé [DMD] – Bernhard Schmidt [DMD]
arch: all any
std-ver: 4.1.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:11.13.1~dfsg-2+deb8u5
o-o-sec: 1:11.13.1~dfsg-2+deb8u8
oldstable: 1:13.14.1~dfsg-2+deb9u4
old-sec: 1:13.14.1~dfsg-2+deb9u4
stable: 1:16.2.1~dfsg-1+deb10u2
testing: 1:16.15.0~dfsg-1
unstable: 1:16.15.0~dfsg-1

versioned links

1:11.13.1~dfsg-2+deb8u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:11.13.1~dfsg-2+deb8u8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:13.14.1~dfsg-2+deb9u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:16.2.1~dfsg-1+deb10u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:16.15.0~dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

asterisk (16 bugs: 0, 9, 7, 0)
asterisk-config (1 bugs: 0, 0, 1, 0)
asterisk-dahdi
asterisk-dev
asterisk-doc
asterisk-mobile
asterisk-modules
asterisk-mp3
asterisk-mysql
asterisk-ooh323
asterisk-tests
asterisk-voicemail
asterisk-voicemail-imapstorage
asterisk-voicemail-odbcstorage
asterisk-vpb

action needed

Marked for autoremoval on 18 February: #979372 high

Version 1:16.15.0~dfsg-1 of asterisk is marked for autoremoval from testing on Thu 18 Feb 2021. It is affected by #979372. The removal of asterisk will also cause the removal of (transitive) reverse dependencies: asterisk-flite, asterisk-opus, asterisk-prompt-de. You should try to prevent the removal by fixing these RC bugs.

Created: 2021-01-12 Last update: 2021-01-16 11:34

A new upstream version is available: 16.15.1 high

A new upstream version 16.15.1 is available, you should consider packaging it.

Created: 2020-12-25 Last update: 2021-01-16 07:31

9 security issues in stretch high

There are 9 open security issues in stretch.

1 important issue:

CVE-2020-35652:

8 issues skipped by the security teams:

CVE-2019-12827: Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.
CVE-2019-13161: An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).
CVE-2019-15297: res_pjsip_t38 in Sangoma Asterisk 13.21-cert4, 15.7.3, and 16.5.0 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk.
CVE-2019-18610: An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.
CVE-2019-18790: An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x, 16.x, and 17.x, and Certified Asterisk 13.21, because of an incomplete fix for CVE-2019-18351. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.
CVE-2019-18976: An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.
CVE-2020-28242: An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur.
CVE-2020-28327: A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. and Certified Asterisk before 16.8-cert5. Upon receiving a new SIP Invite, Asterisk did not return the created dialog locked or referenced. This caused a gap between the creation of the dialog object, and its next use by the thread that created it. Depending on some off-nominal circumstances and timing, it was possible for another thread to free said dialog in this gap. Asterisk could then crash when the dialog object, or any of its dependent objects, were dereferenced or accessed next by the initial-creation thread. Note, however, that this crash can only occur when using a connection-oriented protocol (e.g., TCP or TLS, but not UDP) for SIP transport. Also, the remote client must be authenticated, or Asterisk must be configured for anonymous calling.

Please fix them.

Created: 2019-07-13 Last update: 2021-01-05 21:59

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2020-35652:

Please fix it.

Created: 2020-12-29 Last update: 2021-01-05 21:59

3 security issues in buster high

There are 3 open security issues in buster.

1 important issue:

CVE-2020-35652:

2 issues skipped by the security teams:

CVE-2020-28242: An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur.
CVE-2020-28327: A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. and Certified Asterisk before 16.8-cert5. Upon receiving a new SIP Invite, Asterisk did not return the created dialog locked or referenced. This caused a gap between the creation of the dialog object, and its next use by the thread that created it. Depending on some off-nominal circumstances and timing, it was possible for another thread to free said dialog in this gap. Asterisk could then crash when the dialog object, or any of its dependent objects, were dereferenced or accessed next by the initial-creation thread. Note, however, that this crash can only occur when using a connection-oriented protocol (e.g., TCP or TLS, but not UDP) for SIP transport. Also, the remote client must be authenticated, or Asterisk must be configured for anonymous calling.

Please fix them.

Created: 2020-11-06 Last update: 2021-01-05 21:59

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2020-35652:

Please fix it.

Created: 2020-12-29 Last update: 2021-01-05 21:59

lintian reports 3 warnings high

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2020-07-29 Last update: 2020-09-21 06:01

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2020-02-26 Last update: 2020-02-26 10:49

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2019-01-12 Last update: 2019-01-12 00:07

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.1 instead of 4.1.1).

Created: 2017-12-08 Last update: 2020-11-23 19:06

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2020-11-28] asterisk 1:16.15.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2020-11-23] Accepted asterisk 1:16.15.0~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2020-09-26] asterisk REMOVED from testing (Debian testing watch)
[2020-09-05] Accepted asterisk 1:16.2.1~dfsg-1+deb10u2 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Bernhard Schmidt)
[2020-09-03] asterisk 1:16.12.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2020-08-31] Accepted asterisk 1:16.12.0~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2020-05-23] asterisk 1:16.10.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2020-05-20] Accepted asterisk 1:16.10.0~dfsg-1 (source) into unstable (Lucas Kanashiro)
[2019-12-01] Accepted asterisk 1:11.13.1~dfsg-2+deb8u8 (source i386 all) into oldoldstable (Adrian Bunk)
[2019-11-30] Accepted asterisk 1:11.13.1~dfsg-2+deb8u7 (source i386 all) into oldoldstable (Adrian Bunk)
[2019-08-21] Accepted asterisk 1:16.2.1~dfsg-1+deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Bernhard Schmidt)
[2019-07-16] asterisk 1:16.2.1~dfsg-2 MIGRATED to testing (Debian testing watch)
[2019-07-13] Accepted asterisk 1:16.2.1~dfsg-2 (source) into unstable (Bernhard Schmidt)
[2019-03-15] asterisk 1:16.2.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-03-07] Accepted asterisk 1:16.2.1~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2019-03-03] asterisk 1:16.2.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-02-20] Accepted asterisk 1:16.2.0~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2019-01-14] asterisk 1:16.1.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-01-11] Accepted asterisk 1:16.1.1~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2019-01-07] asterisk 1:13.23.1~dfsg-2 MIGRATED to testing (Debian testing watch)
[2019-01-04] Accepted asterisk 1:16.1.0~dfsg-4 (source) into experimental (Bernhard Schmidt)
[2019-01-03] Accepted asterisk 1:13.23.1~dfsg-2 (source) into unstable (Bernhard Schmidt)
[2018-12-22] Accepted asterisk 1:16.1.0~dfsg-3 (source) into experimental (Bernhard Schmidt)
[2018-12-21] Accepted asterisk 1:16.1.0~dfsg-2 (source) into experimental (Bernhard Schmidt)
[2018-12-19] Accepted asterisk 1:16.1.0~dfsg-1 (source) into experimental (Bernhard Schmidt)
[2018-11-14] asterisk 1:13.23.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2018-10-20] Accepted asterisk 1:13.14.1~dfsg-2+deb9u4 (source) into proposed-updates->stable-new, proposed-updates (Bernhard Schmidt)
[2018-10-16] Accepted asterisk 1:13.14.1~dfsg-2+deb9u4 (source) into stable->embargoed, stable (Bernhard Schmidt)
[2018-09-27] Accepted asterisk 1:11.13.1~dfsg-2+deb8u6 (source amd64 all) into oldstable (Markus Koschany)
[2018-09-25] Accepted asterisk 1:13.23.1~dfsg-1 (source) into unstable (Bernhard Schmidt)

bugs [bug history graph]

all: 21
RC: 1
I&N: 11
M&W: 9
F&P: 0
patch: 0

links

homepage
lintian (0, 3)
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
l10n (-, 98)
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:16.15.0~dfsg-1
18 bugs