Your message dated Fri, 07 Jun 2024 12:49:35 +0000
with message-id <e1sfz2f-001xzo...@fasolo.debian.org>
and subject line Bug#1068296: fixed in asterisk 1:20.8.1~dfsg+~cs6.14.40431414-1
has caused the Debian Bug report #1068296,
regarding asterisk: The res_rtp_asterisk DTLS check against ICE candidates
fails when it shouldn't
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1068296: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068296
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: asterisk
Version: 1:16.28.0~dfsg-0+deb11u4
Severity: important
Hello, dear Asterisk maintainers.
This is basically a copy of:
<https://github.com/asterisk/asterisk/issues/503>
The rtp->ice\_active\_remote\_candidates container used to validate the
source of incoming DTLS packets doesn't contain peer reflexive candidates
discovered during negotiation. This is causing the check to fail where it
shouldn't.
```
\[2024-03-29 21:15:09.908\] WARNING\[1866370\]\[C-00000005\]:
res\_rtp\_asterisk.c:3189 \_\_rtp\_recvfrom: 1711746909.20: DTLS packet from
176.98.71.191:51192 dropped. Source not in ICE active candidate list.
```
Bug was introduced as fix for CVE-2023-49786, I see it from the diff in
https://release.debian.org/proposed-updates/bullseye\_diffs/asterisk\_16.28.0~dfsg-0+deb11u4.debdiff
Fix for the bug was introduced in 20.5.2, in unstable repo, but since this is
basically
a regression, I believe it should be fixed in 16.28.0 too. So, what I see as a
proper solution is cherry-picking:
<https://github.com/gtjoseph/asterisk/commit/041122c85ddf8609ce3ccb7920de4b3f3cd1ac6e>
```
$ uname -a
Linux prod-asterisk 5.10.0-28-cloud-amd64 #1 SMP Debian 5.10.209-2 (2024-01-31)
x86\_64 GNU/Linux
```
Regards,
**Oleksandr Kozmenko**
**Server Administrator**
--- End Message ---
--- Begin Message ---
Source: asterisk
Source-Version: 1:20.8.1~dfsg+~cs6.14.40431414-1
Done: Jonas Smedegaard <d...@jones.dk>
We believe that the bug you reported is fixed in the latest version of
asterisk, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1068...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jonas Smedegaard <d...@jones.dk> (supplier of updated asterisk package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 07 Jun 2024 14:10:19 +0200
Source: asterisk
Architecture: source
Version: 1:20.8.1~dfsg+~cs6.14.40431414-1
Distribution: unstable
Urgency: medium
Maintainer: Debian VoIP Team <pkg-voip-maintain...@lists.alioth.debian.org>
Changed-By: Jonas Smedegaard <d...@jones.dk>
Closes: 1059303 1068296 1072739
Changes:
asterisk (1:20.8.1~dfsg+~cs6.14.40431414-1) unstable; urgency=medium
.
[ upstream ]
* new release
+ use PJProject 2.14.1,
which fixes Use-after-free in SRTP media transport;
CVE-2023-37457 CVE-2023-38703;
closes: bug#1059303, thanks to Moritz Mühlenhoff
+ fix regression issues with DTLS client check;
closes: bug#1068296, thanks to Oleksandr Kozmenko
.
[ Jonas Smedegaard ]
* update watch file:
+ track only LTS releases
+ bump to track pjproject 2.14.1
* unfuzz patches
* update copyright info: update coverage
* declare compliance with Debian Policy 4.7.0
* create and restrict access to cache dir;
closes: bug#1072739, thanks to Bastian Triller
* fix rotate main logfiles,
as logfiles use suffix .log since Asterisk 19;
thanks to James Bottomley (see bug#1024822)
Checksums-Sha1:
5e5a50caacffeb7f65a83de0344be4ea15a72f26 5333
asterisk_20.8.1~dfsg+~cs6.14.40431414-1.dsc
450b21cbdd4f92f333b02d202e445b443acb0b2a 11268
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig-Xamr.tar.xz
96bf3ae2008bc5a46c9f894651110db771dc91a3 21936
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig-Xmp3.tar.xz
efd36da4be8883797c8ccb0ca1a41b933c1f19c9 22548
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig-Xopus.tar.xz
cb340d770d39567f887f0a81e96d35e43360b5ed 6343840
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig-Xpjproject.tar.xz
83360dd7f73c470287fde6f5fadcc135c37fdb3a 7351300
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig.tar.xz
6d80e3a53038c9e15e123724042c02f6f780b2ce 136012
asterisk_20.8.1~dfsg+~cs6.14.40431414-1.debian.tar.xz
165e3783d11e2d355b9edce5472fc3c32c6e3d8b 27576
asterisk_20.8.1~dfsg+~cs6.14.40431414-1_amd64.buildinfo
Checksums-Sha256:
153ed3376cb958b763508b9cbe0ce3e924b7d9c48628185967e37be883339715 5333
asterisk_20.8.1~dfsg+~cs6.14.40431414-1.dsc
ba0e753d9e008ad4d55c112dd0dd628fa3ce57e85f7ca5ff117fdc47e90021d8 11268
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig-Xamr.tar.xz
7392b3cc01080322460f028363dba477df3ac25fe9dc25d3aaae20a2d6177e95 21936
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig-Xmp3.tar.xz
1dc2659ade0eb9207a5d22df188690d1528e74374f1e0dbef4a74d824c90c9cf 22548
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig-Xopus.tar.xz
faa3dcf960be6d0b96c21d46d2135e4cf047802bc39004b042c51fd6d41070e1 6343840
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig-Xpjproject.tar.xz
9dfd77447f1e741dd428d4c49560a470778ed744495994b55bf8ea5090abde27 7351300
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig.tar.xz
ad286f15378930931721200b5ff16ae3467a5b200f64b37ac62e95ff7a74aad4 136012
asterisk_20.8.1~dfsg+~cs6.14.40431414-1.debian.tar.xz
b0e6936635fba3312ac542bd8a75822223a8caf71a87f1c6c2a972be16c3af3d 27576
asterisk_20.8.1~dfsg+~cs6.14.40431414-1_amd64.buildinfo
Files:
34caf7bd19b22fd658dc11269c97beaf 5333 comm optional
asterisk_20.8.1~dfsg+~cs6.14.40431414-1.dsc
2f288da7d163b555955e1351203cb972 11268 comm optional
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig-Xamr.tar.xz
e36d4f45ad47523be5f21a88e8b6c0d8 21936 comm optional
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig-Xmp3.tar.xz
a28346e11689859feea371218e977f53 22548 comm optional
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig-Xopus.tar.xz
d97bc16dd8abacb0bcf4b816da13573e 6343840 comm optional
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig-Xpjproject.tar.xz
b4ecd3792eab910d1e508c2f7baaeb50 7351300 comm optional
asterisk_20.8.1~dfsg+~cs6.14.40431414.orig.tar.xz
9e368480946b9ea7b95eebbafbfe4a9b 136012 comm optional
asterisk_20.8.1~dfsg+~cs6.14.40431414-1.debian.tar.xz
dff32842a5a98a5e89c919841d58bf51 27576 comm optional
asterisk_20.8.1~dfsg+~cs6.14.40431414-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEn+Ppw2aRpp/1PMaELHwxRsGgASEFAmZi/fAACgkQLHwxRsGg
ASGv4g//SAMNFdSEJnQVMxgcq/lk9OmmDW6E6v1SMGupOoBB4Nfc58X0AJhygYFk
klNg5m9itYNtrrIYEBn+iU8Mk04z/M/N+8HZXH7PU4PzXEvyE3Io+QPXSshgwvTs
t0MtchCBvWHZk0VR2RJTxcZwcDbrmUHF2tSAzbYQAy2neAZXEM88k05tisFacOdx
h6NrWhx+IMkoxxWoFxVt/8mR0UZ9q7nlMCb6NdyH1tvjN0+3s9g4MSFwMQsVlvgI
G6G6+DJacEC2DF8gaeH3dmYyHDBA9wVXThnmRViocMBQp76LhXkciyFXXpbAxOz8
2RtrpYDt2DwrVxeHEHXsAFtl6NEbBkHVHDnpVHNq3V+U2/ZbYV6ve1eGFplttiWj
21pJ5klx+i/Oc/JYLXSTjB6JtvMZk4XbfqF1EHilLXFeNR/zzfadtJEuVZDnBpJJ
xNbvxo2hmgFi1hQqYRNsDjVOkP6Mr3c4Y1QZHiWy7xur93zpatcJ9YtmaYEp1g27
Wf8GWwUi6Ps27DV09HZW2zaNb7m5s0TB04ifbegxbc0D0FOi/gKYxx7HhXT4laYg
yAOVKbZB2DyQHgX/UX8YnqKSpauTt071go9Ppzhd64oS44t/vKgxbEk4qiTgfxH1
HSdkj2BpUarL4t7sQHlejKQ4DpNGA3d1apmg3lk92+gzDW1j+/0=
=RzJZ
-----END PGP SIGNATURE-----
pgphl6I_yt9Ns.pgp
Description: PGP signature
--- End Message ---