From 5ed26bb378c02f2ce7f7377481853b12ad55d808 Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Sat, 26 Feb 2022 17:05:03 +0100 Subject: [PATCH] package/libpjsip: security bump to version 2.12 Fix the following security issues (i.e. CVE-2021-37706, CVE-2021-41141, CVE-2021-43804, CVE-2021-43845, CVE-2022-21722 and CVE-2022-21723): - Potential integer underflow upon receiving STUN message (GHSA-2qpg-f6wf-w984) - Use after free of dialog set (GHSA-ffff-m5fm-qm62) - Missing unreleased of locks in failure cases (GHSA-8fmx-hqw7-6gmc) - Potential out-of-bounds read when parsing RTCP BYE message (GHSA-3qx3-cg72-wrh9) - Prevent OOB read for RTCP XR block (GHSA-r374-qrwv-86hh) - Potential buffer overflow in pjsua_player_create(), pjsua_recorder_create(), pjmedia_wav_player_create(), and pjsua_call_dump() (GHSA-qcvw-h34v-c7r9) - Potential out-of-bound read during RTP/RTCP parsing (GHSA-m66q-q64c-hv36) - Prevent OOB read in multipart parsing (GHSA-7fw8-54cv-r7pm) - Use after free of dialog set (GHSA-ffff-m5fm-qm62) https://github.com/pjsip/pjproject/releases/tag/2.12 Signed-off-by: Fabrice Fontaine Signed-off-by: Peter Korsgaard --- package/libpjsip/libpjsip.hash | 2 +- package/libpjsip/libpjsip.mk | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/libpjsip/libpjsip.hash b/package/libpjsip/libpjsip.hash index f39ebf4060..74331ab6fb 100644 --- a/package/libpjsip/libpjsip.hash +++ b/package/libpjsip/libpjsip.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 45f6604372df3f49293749cd7c0b42cb21c4fb666c66f8ed9765de004d1eae38 pjproject-2.11.1.tar.gz +sha256 b3b94d9be4aba8f6d2d1cb164603e81b0a6ee17352f9e2ba5b58e325e610ca5a pjproject-2.12.tar.gz sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING diff --git a/package/libpjsip/libpjsip.mk b/package/libpjsip/libpjsip.mk index b05cc31a83..32cfa8c53c 100644 --- a/package/libpjsip/libpjsip.mk +++ b/package/libpjsip/libpjsip.mk @@ -4,10 +4,10 @@ # ################################################################################ -LIBPJSIP_VERSION = 2.11.1 +LIBPJSIP_VERSION = 2.12 LIBPJSIP_SOURCE = pjproject-$(LIBPJSIP_VERSION).tar.gz LIBPJSIP_SITE = $(call github,pjsip,pjproject,$(LIBPJSIP_VERSION)) -# https://github.com/pjsip/pjproject/archive/2.11.1.tar.gz +# https://github.com/pjsip/pjproject/archive/2.12.tar.gz LIBPJSIP_DEPENDENCIES = libsrtp LIBPJSIP_LICENSE = GPL-2.0+