Debian Package Tracker

general

source: asterisk (main)
version: 1:16.10.0~dfsg-1
maintainer: Debian VoIP Team (archive) (DMD)
uploaders: Mark Purcell [DMD] – Bernhard Schmidt [DMD] – Tzafrir Cohen [DMD] – Jonas Smedegaard [DMD] – Jeremy Lainé [DMD] – Daniel Pocock [DMD]
arch: all any
std-ver: 4.1.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:11.13.1~dfsg-2+deb8u5
o-o-sec: 1:11.13.1~dfsg-2+deb8u8
oldstable: 1:13.14.1~dfsg-2+deb9u4
old-sec: 1:13.14.1~dfsg-2+deb9u4
stable: 1:16.2.1~dfsg-1+deb10u1
testing: 1:16.10.0~dfsg-1
unstable: 1:16.10.0~dfsg-1

versioned links

1:11.13.1~dfsg-2+deb8u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:11.13.1~dfsg-2+deb8u8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:13.14.1~dfsg-2+deb9u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:16.2.1~dfsg-1+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:16.10.0~dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

asterisk (15 bugs: 0, 9, 6, 0)
asterisk-config (1 bugs: 0, 0, 1, 0)
asterisk-dahdi
asterisk-dev
asterisk-doc
asterisk-mobile
asterisk-modules
asterisk-mp3
asterisk-mysql
asterisk-ooh323
asterisk-tests
asterisk-voicemail
asterisk-voicemail-imapstorage
asterisk-voicemail-odbcstorage
asterisk-vpb

action needed

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2020-05-24 Last update: 2020-06-05 09:41

lintian reports 5 warnings normal

Lintian reports 5 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2020-05-21 Last update: 2020-05-21 00:01

3 ignored security issues in buster low

There are 3 open security issues in buster.

3 issues skipped by the security teams:

CVE-2019-18610: An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.
CVE-2019-15297: res_pjsip_t38 in Sangoma Asterisk 13.21-cert4, 15.7.3, and 16.5.0 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk.
CVE-2019-18790: An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x, 16.x, and 17.x, and Certified Asterisk 13.21, because of an incomplete fix for CVE-2019-18351. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.

Please fix them.

Created: 2019-09-11 Last update: 2020-05-23 06:12

1 ignored security issue in jessie low

There is 1 open security issue in jessie.

1 issue skipped by the security teams:

CVE-2019-13161: An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).

Please fix it.

Created: 2019-12-01 Last update: 2020-05-23 06:12

6 ignored security issues in stretch low

There are 6 open security issues in stretch.

6 issues skipped by the security teams:

CVE-2019-18610: An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.
CVE-2019-13161: An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).
CVE-2019-18976: An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.
CVE-2019-12827: Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.
CVE-2019-15297: res_pjsip_t38 in Sangoma Asterisk 13.21-cert4, 15.7.3, and 16.5.0 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk.
CVE-2019-18790: An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x, 16.x, and 17.x, and Certified Asterisk 13.21, because of an incomplete fix for CVE-2019-18351. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.

Please fix them.

Created: 2019-07-13 Last update: 2020-05-23 06:12

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2020-02-26 Last update: 2020-02-26 10:49

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2019-01-12 Last update: 2019-01-12 00:07

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.0 instead of 4.1.1).

Created: 2017-12-08 Last update: 2020-05-21 04:47

news

[rss feed]

[2020-05-23] asterisk 1:16.10.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2020-05-23] asterisk 1:16.10.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2020-05-20] Accepted asterisk 1:16.10.0~dfsg-1 (source) into unstable (Lucas Kanashiro)
[2019-12-01] Accepted asterisk 1:11.13.1~dfsg-2+deb8u8 (source i386 all) into oldoldstable (Adrian Bunk)
[2019-11-30] Accepted asterisk 1:11.13.1~dfsg-2+deb8u7 (source i386 all) into oldoldstable (Adrian Bunk)
[2019-08-21] Accepted asterisk 1:16.2.1~dfsg-1+deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Bernhard Schmidt)
[2019-07-16] asterisk 1:16.2.1~dfsg-2 MIGRATED to testing (Debian testing watch)
[2019-07-16] asterisk 1:16.2.1~dfsg-2 MIGRATED to testing (Debian testing watch)
[2019-07-13] Accepted asterisk 1:16.2.1~dfsg-2 (source) into unstable (Bernhard Schmidt)
[2019-03-15] asterisk 1:16.2.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-03-07] Accepted asterisk 1:16.2.1~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2019-03-03] asterisk 1:16.2.0~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-02-20] Accepted asterisk 1:16.2.0~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2019-01-14] asterisk 1:16.1.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-01-14] asterisk 1:16.1.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-01-11] Accepted asterisk 1:16.1.1~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2019-01-07] asterisk 1:13.23.1~dfsg-2 MIGRATED to testing (Debian testing watch)
[2019-01-04] Accepted asterisk 1:16.1.0~dfsg-4 (source) into experimental (Bernhard Schmidt)
[2019-01-03] Accepted asterisk 1:13.23.1~dfsg-2 (source) into unstable (Bernhard Schmidt)
[2018-12-22] Accepted asterisk 1:16.1.0~dfsg-3 (source) into experimental (Bernhard Schmidt)
[2018-12-21] Accepted asterisk 1:16.1.0~dfsg-2 (source) into experimental (Bernhard Schmidt)
[2018-12-19] Accepted asterisk 1:16.1.0~dfsg-1 (source) into experimental (Bernhard Schmidt)
[2018-11-14] asterisk 1:13.23.1~dfsg-1 MIGRATED to testing (Debian testing watch)
[2018-10-20] Accepted asterisk 1:13.14.1~dfsg-2+deb9u4 (source) into proposed-updates->stable-new, proposed-updates (Bernhard Schmidt)
[2018-10-16] Accepted asterisk 1:13.14.1~dfsg-2+deb9u4 (source) into stable->embargoed, stable (Bernhard Schmidt)
[2018-09-27] Accepted asterisk 1:11.13.1~dfsg-2+deb8u6 (source amd64 all) into oldstable (Markus Koschany)
[2018-09-25] Accepted asterisk 1:13.23.1~dfsg-1 (source) into unstable (Bernhard Schmidt)
[2018-09-08] asterisk 1:13.22.0~dfsg-2 MIGRATED to testing (Debian testing watch)
[2018-09-05] Accepted asterisk 1:13.22.0~dfsg-2 (source) into unstable (Bernhard Schmidt)
[2018-07-28] asterisk 1:13.22.0~dfsg-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 24
RC: 0
I&N: 15
M&W: 9
F&P: 0
patch: 0

links

homepage
lintian (0, 5)
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker
screenshots
l10n (-, 98)
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:16.10.0~dfsg-1
17 bugs