package/asterisk: security bump to version 16.14.1

Fixes the following security issues:

- AST-2020-001: Remote crash in res_pjsip_session
  Upon receiving a new SIP Invite, Asterisk did not return the created
  dialog locked or referenced.

- AST-2020-002: Outbound INVITE loop on challenge with different nonce
  If Asterisk is challenged on an outbound INVITE and the nonce is changed
  in each response, Asterisk will continually send INVITEs in a loop.  This
  causes Asterisk to consume more and more memory since the transaction will
  never terminate (even if the call is hung up), ultimately leading to a
  restart or shutdown of Asterisk.  Outbound authentication must be
  configured on the endpoint for this to occur.

For details, see the announcement:
https://www.asterisk.org/asterisk-news/asterisk-13-37-1-16-14-1-17-8-1-18-0-1-and-16-8-cert5-now-available-security/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Peter Korsgaard 2020-11-12 13:44:08 +01:00
parent a325eefc1b
commit 339d3e82e8
2 changed files with 2 additions and 2 deletions

View File

@ -1,5 +1,5 @@
# Locally computed
sha256 5ebefa6387f89695361b8c105e2ad7ee6381f87a99012aeb85b886ddf6d518ac asterisk-16.13.0.tar.gz
sha256 226eaef400d2d335ce29d7b3c8aca8dfdfc5e854c215e0c47615c095ced12171 asterisk-16.14.1.tar.gz
# sha1 from: http://downloads.asterisk.org/pub/telephony/sounds/releases
# sha256 locally computed

View File

@ -4,7 +4,7 @@
#
################################################################################
ASTERISK_VERSION = 16.13.0
ASTERISK_VERSION = 16.14.1
# Use the github mirror: it's an official mirror maintained by Digium, and
# provides tarballs, which the main Asterisk git tree (behind Gerrit) does not.
ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))