Change:
, CVSSv3=9.8 (nixos-unstable) CVSSv3=9.1 (nixos-unstable) CVSSv3=7.5 (nixos-unstable) An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14. An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2. An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2. Scanned versions: nixos-unstable: . Cc Cc Cc

Discussion:
lua, speex, libopus, opusfile, libogg, srtp, wget, curl, iksemel, pkg-config, autoconf, libtool, automake, <ins> python39, writeScript, </ins> withOpus ? true, }:

}; }; <del> pjproject_2_10 = fetchurl { url = "https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.10/pjproject-2.10.tar.bz2"; sha256 = "14qmddinm4bv51rl0wwg5133r64x5bd6inwbx27ahb2n0151m2if"; </del> <ins> pjproject_2_12 = fetchurl { url = "https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.12/pjproject-2.12.tar.bz2"; hash = "sha256-T3q4r/4WCAZCNGnULxMnNKH9wEK7gkseV/sV8IPasHQ="; </ins> }; mp3-202 = fetchsvn {

versions = lib.mapAttrs (_: {version, sha256}: common { inherit version sha256; externals = { <del> "externals_cache/pjproject-2.10.tar.bz2" = pjproject_2_10; </del> <ins> "externals_cache/pjproject-2.12.tar.bz2" = pjproject_2_12; </ins> "addons/mp3" = mp3-202; }; }) (lib.importJSON ./versions.json); <ins> updateScript_python = python39.withPackages (p: with p; [ packaging beautifulsoup4 requests ]); updateScript = writeScript "asterisk-update" '' #!/usr/bin/env bash exec ${updateScript_python}/bin/python ${toString ./update.py} ''; </ins> in { # Supported releases (as of 2022-04-05). # Source: https://wiki.asterisk.org/wiki/display/AST/Asterisk+Versions

# 19.x    Standard   2021-11-02  2022-11-02  2023-11-02 asterisk-lts = versions.asterisk_18; asterisk-stable = versions.asterisk_19; <del> asterisk = versions.asterisk_19; </del> <ins> asterisk = versions.asterisk_19.overrideAttrs (o: { passthru = (o.passthru or {}) // { inherit updateScript; }; }); </ins> } // versions

#!/usr/bin/env nix-shell #!nix-shell -i python3 -p python39 python39.pkgs.packaging python39.pkgs.beautifulsoup4 python39.pkgs.requests <ins> # mirrored in ./default.nix </ins> from packaging import version from bs4 import BeautifulSoup import re, requests, json <ins> import os, sys from pathlib import Path </ins> URL = "https://downloads.asterisk.org/pub/telephony/asterisk"

"sha256": sha } <ins> versions_path = Path(sys.argv[0]).parent / "versions.json" </ins> try: <del> with open("versions.json", "r") as in_file: </del> <ins> with open(versions_path, "r") as in_file: </ins> in_data = json.loads(in_file.read()) for v in in_data.keys(): print(v + ":", in_data[v]["version"], "->", out[v]["version"])

# nice to have for the PR, not a requirement pass <del> with open("versions.json", "w") as out_file: </del> <ins> with open(versions_path, "w") as out_file: </ins> out_file.write(json.dumps(out, sort_keys=True, indent=2) + "n")

{ "asterisk_16": { <del> "sha256": "379c5529b9957c28734192999543486a0b0b24f6671b2e02e77cc809774e7ba9", "version": "16.25.1" </del> <ins> "sha256": "201c92e591fc1db2c71b264907beef594d62d660168d42b5e83f9dc593b1bce0", "version": "16.26.1" </ins> }, "asterisk_18": { <del> "sha256": "9db0e94e005a91a5433fc11173247065a5c40c9a7ca946577908f65d130b888e", "version": "18.11.1" </del> <ins> "sha256": "acbb58e5c3cd2b9c7c4506fa80b717c3c3c550ce9722ff0177b4f11f98725563", "version": "18.12.1" </ins> }, "asterisk_19": { <del> "sha256": "3e1fa31ef1de7813365dd8b98ef93744ff87902255472814d0232b955c794706", "version": "19.3.1" </del> <ins> "sha256": "6b0b985163f20fcc8f8878069b8a9ee725eef4cfbdb1c1031fe3840fb32d7abe", "version": "19.4.1" </ins> } }