net-misc/asterisk: 13.19.2 for CVE-2018-7284 & CVE-2018-7286
authorTony Vroon <chainsaw@gentoo.org>
Fri, 9 Mar 2018 16:04:25 +0000 (16:04 +0000)
committerTony Vroon <chainsaw@gentoo.org>
Fri, 9 Mar 2018 16:04:46 +0000 (16:04 +0000)
commit458b342d0d2bbb84666f320612f6a6fc9c061903
tree1aa10e8ae4284e1d662516e2c65b190a31a5ff2f
parentd49dbc12b46bb508067e83673fab6336d8cd0d4c
net-misc/asterisk: 13.19.2 for CVE-2018-7284 & CVE-2018-7286

Both vulnerabilities are in res_pjsip and allow a remote DoS. One through sending
a lot of SIP INVITE messages on SIP TCP or SIP-TLS channels and then tearing them
down. The other involves a SUBSCRIBE request containing more than 32 Accept headers,
which overflows the statically allocated buffer.
If you prevent res_pjsip from loading and use the classic chan_sip driver, you may
not be vulnerable. However, this upgrade is being pushed out to all.

Package-Manager: Portage-2.3.19, Repoman-2.3.6
net-misc/asterisk/Manifest
net-misc/asterisk/asterisk-13.19.2.ebuild [new file with mode: 0644]