telephony, branch lede-17.01The telephony packages feedhttp://x-nagi.com/cgit/telephony/atom?h=lede-17.012019-12-01T21:21:24ZMerge pull request #490 from micmac1/17.01-AST-2019-006_007_0082019-12-01T21:21:24ZJiri Slachtajiri@slachta.eu2019-12-01T21:21:24Zurn:sha1:4a189f3e21227bc7383cccda6b621ee3f2e61c98
[17.01] asterisk-13.x: add fixes for AST-2019-006, 007 & 008asterisk-13.x: add fixes for AST-2019-006, 007 & 0082019-11-22T20:18:13ZSebastian Kempersebastian_ml@gmx.net2019-11-22T20:18:11Zurn:sha1:15307b4c3841ee2dfeeadb916fd20776774938e0
https://downloads.asterisk.org/pub/security/AST-2019-006.html
https://downloads.asterisk.org/pub/security/AST-2019-007.html
https://downloads.asterisk.org/pub/security/AST-2019-008.html
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Merge pull request #435 from micmac1/17-ast13-AST-2019-0032019-07-12T20:14:51ZJiri Slachtajiri@slachta.eu2019-07-12T20:14:51Zurn:sha1:039faa9ef975fc44dd9ef3c022f7d4e7c7e4222f
(for 17.01) asterisk-13.x: fix AST-2019-003asterisk-13.x: fix AST-2019-0032019-07-12T17:24:49ZSebastian Kempersebastian_ml@gmx.net2019-07-12T17:24:42Zurn:sha1:15e6a1b558aced85f4ffac1ea388a217312085d0
https://downloads.asterisk.org/pub/security/AST-2019-003.html
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Merge pull request #375 from micmac1/AST-2018-009-17.012018-09-21T14:49:07ZJiri Slachtajiri.slachta@gmail.com2018-09-21T14:49:07Zurn:sha1:31398a3759c99bdb2dca359b78e25c17b6dd434a
(17.01) Fix for AST-2018-009Merge pull request #372 from micmac1/kama-led-cve2018-09-21T14:47:50ZJiri Slachtajiri.slachta@gmail.com2018-09-21T14:47:50Zurn:sha1:b987aecf91399568a0b11943a0ae7229148dd5c2
(LEDE 17.01) kamailio-4.x: add fix for CVE-2018-16657asterisk-13.x: fix for AST-2018-0092018-09-20T21:57:36ZSebastian Kempersebastian_ml@gmx.net2018-09-20T21:57:34Zurn:sha1:7f99c1f7e0c1d34c45af255ef512063fd5c22993
Add upstream fix for AST-2018-009: Remote crash vulnerability in HTTP
websocket upgrade
The vulnerability affects the res_http_websocket.so module.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
kamailio-4.x: add fix for CVE-2018-166572018-09-12T18:29:57ZSebastian Kempersebastian_ml@gmx.net2018-09-12T18:29:55Zurn:sha1:2387ec07a4ab728627e2d21b6c84e01166a3912e
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with
an invalid Via header causes a segmentation fault and crashes Kamailio. The
reason is missing input validation in the crcitt_string_array core function
for calculating a CRC hash for To tags. (An additional error is present in
the check_via_address core function: this function also misses input
validation.) This could result in denial of service and potentially the
execution of arbitrary code.
Patch from upstream. File paths amended for 4.x release.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
Merge pull request #362 from micmac1/kam-cve-17.01-II2018-08-11T11:05:54ZJiri Slachtajiri.slachta@gmail.com2018-08-11T11:05:54Zurn:sha1:95498e75db5c6741cd53f8746ffc1473c72b6e5d
kamailio-4.x: add fix for CVE-2018-14767kamailio-4.x: add fix for CVE-2018-147672018-08-06T22:21:22ZSebastian Kempersebastian_ml@gmx.net2018-08-06T22:21:20Zurn:sha1:c48758551a8b4a56ed506920370618470af2ac08
CVE-2018-14767: "In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a
crafted SIP message with a double "To" header and an empty "To" tag
causes a segmentation fault and crash. The reason is missing input
validation in the "build_res_buf_from_sip_req" core function. This could
result in denial of service and potentially the execution of arbitrary
code."
Patch from upstream. Path to msg_translator.c amended.
Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>