From nobody Sat Mar 05 09:38:00 2022 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id DE56D19F552F; Sat, 5 Mar 2022 09:38:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4K9flr5xGgz3QDD; Sat, 5 Mar 2022 09:38:00 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1646473080; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=CmH4Src7UbhtyR5PatRHMvqWmNhos2TvCy3tqRMTK0E=; b=itkoPKo0uCrupuWgWl1mfvMgvsqBu5ZsRzRTpiOz8tm0y2NsD87iW+1rBFmSNjYVhyZt1u d6QSd+SjCfeTsXjm8kzAmPhqwWDL+aJu3DYRcQtaXZMt988+6wc9OsF0ggXWq030MJrS35 NcwQFlVZ8NKJ6yABvuquX0JjkibbhC8dWg3HcpA/BwEAr1tHLFs7HSAhGqwnQ/4Izr/caD gY0cdkH4mZa+UhBJxsDNDnrbDg8o9/Kw5hkj4c1heepgdO7etiINFfTFwmhG9KYODaXTOK Y7BO/9jRxUweuMqDwGBCVjNvMV0V9Uzf/9kHtoYlVRQqF+AEARummUQ/NZWZPA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id ABA031E028; Sat, 5 Mar 2022 09:38:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 2259c0f6085257; Sat, 5 Mar 2022 09:38:00 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 2259c04q085256; Sat, 5 Mar 2022 09:38:00 GMT (envelope-from git) Date: Sat, 5 Mar 2022 09:38:00 GMT Message-Id: <202203050938.2259c04q085256@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Guido Falsi Subject: git: 44b6cff71756 - main - security/vuxml: Report new asterisk vulnerabilities. List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: madpilot X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 44b6cff717564bdc13636126696842a283b76130 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1646473080; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=CmH4Src7UbhtyR5PatRHMvqWmNhos2TvCy3tqRMTK0E=; b=gOiPJzf8WKKvL1mlhAt2ivvBK/bAhYP4TtPiCzlwMV/wSwl+BuYk1ZAT5tF15k0zEKVOl6 9BhV2rh590vUC1QL+KD8O0ikOO1LoXxmBxYZvBRpqLFyA8OvQGkYC0fTMFQhGppNqvnwpT e2AidYFDHT2MdyRFPFG3BiGHpHX9MzrOyirEki3E/HtA31Rj9yp0D2MZNYL7x2/NDx+g8U WZS8LjBQIiAdGL3tu8+5042JXm1Px2sDhWfTH8/xEhaJn3z763HeNOMZNViUjoNI7cXFT1 1ZQ8AxZueOsA1RAd6H07DHEN6e8cd6SsKNLVCofKopYoxy2hXEfBMu83M0Wbaw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1646473080; a=rsa-sha256; cv=none; b=HqBLSIEfgFki0ziEDFJ56q0tf/cK1vpPbW7c+CJn/SW1gUI4pU0Lcc4LmLvzmClcnd8biZ L6bYjlaRWvZge+w623qJ9E/CE/zRGdEWymKo/hkC76P2iJ7bAT//w6uvbCNNQqkK50F9iE DnBtmqwRwgzzkRNI3cfeIzRwrvkRMUYqc5LKMDHeylI+iSlFIxXhZVpjOsHZL5bitM7l7R EbQZ/JDUUlOCHZksR0Rbxng6bMMhNxxMe6f8p6u7CWUlfjn0ZBT5lcBv2wRfUr4awAWOGK Oh4thKMpjD1+e1kJpwn44yjwfd1NbpS/BLCJITc227XPCMeuH8MyIeW5BrqmpA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by madpilot: URL: https://cgit.FreeBSD.org/ports/commit/?id=44b6cff717564bdc13636126696842a283b76130 commit 44b6cff717564bdc13636126696842a283b76130 Author: Guido Falsi AuthorDate: 2022-03-05 09:37:17 +0000 Commit: Guido Falsi CommitDate: 2022-03-05 09:37:17 +0000 security/vuxml: Report new asterisk vulnerabilities. --- security/vuxml/vuln-2022.xml | 48 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml index 961be186f329..69de14c1d2c9 100644 --- a/security/vuxml/vuln-2022.xml +++ b/security/vuxml/vuln-2022.xml @@ -1,3 +1,51 @@ + + asterisk -- multiple vulnerabilities + + + asterisk16 + 16.24.1 + + + asterisk18 + 18.10.1 + + + + +

The Asterisk project reports:

+
+

AST-2022-004 - The header length on incoming STUN + messages that contain an ERROR-CODE attribute is not + properly checked. This can result in an integer underflow. + Note, this requires ICE or WebRTC support to be in use + with a malicious remote party.

+

AST-2022-005 - When acting as a UAC, and when placing + an outgoing call to a target that then forks Asterisk may + experience undefined behavior (crashes, hangs, etc) after + a dialog set is prematurely freed.

+

AST-2022-006 - If an incoming SIP message contains a + malformed multi-part body an out of bounds read access + may occur, which can result in undefined behavior. Note, + its currently uncertain if there is any externally + exploitable vector within Asterisk for this issue, but + providing this as a security issue out of caution.

+
+ + + + CVE-2021-37706 + CVE-2022-23608 + CVE-2022-21723 + https://downloads.asterisk.org/pub/security/AST-2022-004.html + https://downloads.asterisk.org/pub/security/AST-2022-005.html + https://downloads.asterisk.org/pub/security/AST-2022-006.html + + + 2022-03-03 + 2022-03-05 + + + chromium -- multiple vulnerabilities