asterisk - Debian Package Tracker

general

source: asterisk (main)
version: 1:16.16.1~dfsg-2
maintainer: Debian VoIP Team (archive) (DMD)
uploaders: Mark Purcell [DMD] – Bernhard Schmidt [DMD] – Tzafrir Cohen [DMD] – Jonas Smedegaard [DMD] – Jeremy Lainé [DMD]
arch: all any
std-ver: 4.1.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:13.14.1~dfsg-2+deb9u4
o-o-sec: 1:13.14.1~dfsg-2+deb9u5
oldstable: 1:16.2.1~dfsg-1+deb10u2
old-bpo: 1:16.16.1~dfsg-1~bpo10+1
stable: 1:16.16.1~dfsg-1
testing: 1:16.16.1~dfsg-2
unstable: 1:16.16.1~dfsg-2

versioned links

1:13.14.1~dfsg-2+deb9u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:13.14.1~dfsg-2+deb9u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:16.2.1~dfsg-1+deb10u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:16.16.1~dfsg-1~bpo10+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:16.16.1~dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:16.16.1~dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

asterisk (17 bugs: 0, 10, 7, 0)
asterisk-config (1 bugs: 0, 0, 1, 0)
asterisk-dahdi
asterisk-dev
asterisk-doc
asterisk-mobile
asterisk-modules
asterisk-mp3
asterisk-mysql
asterisk-ooh323
asterisk-tests
asterisk-voicemail
asterisk-voicemail-imapstorage
asterisk-voicemail-odbcstorage
asterisk-vpb

action needed

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:07:42
Last run: 2021-08-06T23:34:55.000Z
Previous status: pass

testing: fail (log)
The tests ran in 0:06:43
Last run: 2021-08-17T11:03:44.000Z
Previous status: pass

stable: pass (log)
The tests ran in 0:05:00
Last run: 2021-07-26T01:34:25.000Z
Previous status: tmpfail

Created: 2021-08-17 Last update: 2021-09-16 16:10

A new upstream version is available: 16.20.0 high

A new upstream version 16.20.0 is available, you should consider packaging it.

Created: 2021-04-12 Last update: 2021-09-16 11:35

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

Created: 2021-08-06 Last update: 2021-09-11 17:35

7 security issues in buster high

There are 7 open security issues in buster.

2 important issues:

CVE-2021-32558: An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.
CVE-2021-32686: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash, resulting in a denial of service. These are fixed in version 2.11.1.

5 issues left for the package maintainer to handle:

CVE-2020-28242: (needs triaging) An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur.
CVE-2020-28327: (needs triaging) A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. and Certified Asterisk before 16.8-cert5. Upon receiving a new SIP Invite, Asterisk did not return the created dialog locked or referenced. This caused a gap between the creation of the dialog object, and its next use by the thread that created it. Depending on some off-nominal circumstances and timing, it was possible for another thread to free said dialog in this gap. Asterisk could then crash when the dialog object, or any of its dependent objects, were dereferenced or accessed next by the initial-creation thread. Note, however, that this crash can only occur when using a connection-oriented protocol (e.g., TCP or TLS, but not UDP) for SIP transport. Also, the remote client must be authenticated, or Asterisk must be configured for anonymous calling.
CVE-2020-35652: (needs triaging) An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, and 18.x before 18.1.0. A crash can occur when a SIP message is received with a History-Info header that contains a tel-uri, or when a SIP 181 response is received that contains a tel-uri in the Diversion header.
CVE-2020-35776: (postponed; to be fixed through a stable update) A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses.
CVE-2021-26906: (postponed; to be fixed through a stable update) An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure.

You can find information about how to handle these issues in the security team's documentation.

Created: 2021-02-19 Last update: 2021-09-09 04:05

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2021-32558: An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.
CVE-2021-32686: PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They cause a crash, resulting in a denial of service. These are fixed in version 2.11.1.

Created: 2021-07-28 Last update: 2021-09-09 04:05

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2021-08-14 Last update: 2021-09-16 16:00

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2020-02-26 Last update: 2020-02-26 10:49

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2019-01-12 Last update: 2019-01-12 00:07

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.0 instead of 4.1.1).

Created: 2017-12-08 Last update: 2021-08-18 14:02

testing migrations

This package will soon be part of the auto-openldap transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-unixodbc transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2021-08-16] asterisk 1:16.16.1~dfsg-2 MIGRATED to testing (Debian testing watch)
[2021-08-06] Accepted asterisk 1:16.16.1~dfsg-2 (source) into unstable (Bernhard Schmidt)
[2021-08-04] Accepted asterisk 1:13.14.1~dfsg-2+deb9u5 (source all amd64) into oldstable (Chris Lamb)
[2021-03-16] Accepted asterisk 1:16.16.1~dfsg-1~bpo10+1 (source all amd64) into buster-backports->backports-policy, buster-backports (Debian FTP Masters) (signed by: Bernhard Schmidt)
[2021-03-06] asterisk 1:16.16.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2021-02-23] Accepted asterisk 1:16.16.1~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2021-01-20] asterisk 1:16.15.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2021-01-17] Accepted asterisk 1:16.15.1~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2020-11-28] asterisk 1:16.15.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2020-11-23] Accepted asterisk 1:16.15.0~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2020-09-26] asterisk REMOVED from testing (Debian testing watch)
[2020-09-05] Accepted asterisk 1:16.2.1~dfsg-1+deb10u2 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Bernhard Schmidt)
[2020-09-03] asterisk 1:16.12.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2020-08-31] Accepted asterisk 1:16.12.0~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2020-05-23] asterisk 1:16.10.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2020-05-20] Accepted asterisk 1:16.10.0~dfsg-1 (source) into unstable (Lucas Kanashiro)
[2019-12-01] Accepted asterisk 1:11.13.1~dfsg-2+deb8u8 (source i386 all) into oldoldstable (Adrian Bunk)
[2019-11-30] Accepted asterisk 1:11.13.1~dfsg-2+deb8u7 (source i386 all) into oldoldstable (Adrian Bunk)
[2019-08-21] Accepted asterisk 1:16.2.1~dfsg-1+deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Bernhard Schmidt)
[2019-07-16] asterisk 1:16.2.1~dfsg-2 MIGRATED to testing (Debian testing watch)
[2019-07-13] Accepted asterisk 1:16.2.1~dfsg-2 (source) into unstable (Bernhard Schmidt)
[2019-03-15] asterisk 1:16.2.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-03-07] Accepted asterisk 1:16.2.1~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2019-03-03] asterisk 1:16.2.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-02-20] Accepted asterisk 1:16.2.0~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2019-01-14] asterisk 1:16.1.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-01-11] Accepted asterisk 1:16.1.1~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2019-01-07] asterisk 1:13.23.1~dfsg-2 MIGRATED to testing (Debian testing watch)
[2019-01-04] Accepted asterisk 1:16.1.0~dfsg-4 (source) into experimental (Bernhard Schmidt)
[2019-01-03] Accepted asterisk 1:13.23.1~dfsg-2 (source) into unstable (Bernhard Schmidt)

bugs [bug history graph]

all: 23
RC: 0
I&N: 14
M&W: 9
F&P: 0
patch: 1

links

homepage
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
l10n (-, 98)
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:16.16.1~dfsg-2
18 bugs (1 patch)