[asterisk-bugs] [JIRA] (ASTERISK-29980) Installer uses downloads from insecure URL

[Joshua C. Colp (JIRA)]

     [ https://issues.asterisk.org/jira/browse/ASTERISK-29980?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Joshua C. Colp updated ASTERISK-29980:
--------------------------------------

    Security: None  (was: Reporter, Bug Marshals, and Digium)

> Installer uses downloads from insecure URL
> ------------------------------------------
>
>                 Key: ASTERISK-29980
>                 URL: https://issues.asterisk.org/jira/browse/ASTERISK-29980
>             Project: Asterisk
>          Issue Type: Improvement
>      Security Level: None
>          Components: Codecs/codec_opus
>    Affects Versions: 19.2.1
>            Reporter: INVADE International Ltd.
>            Severity: Blocker
>              Labels: security
>
> If we include the OPUS codec as part of an installation, it is sourced as follows:
> codec_opus: Downloading http://downloads.digium.com/pub/telephony/codec_opus/asterisk-19.0/x86-64/codec_opus-19.0_1.3.0-x86_64.tar.gz to /tmp/tmp.MzytcugTdk/codec_opus-19.0_1.3.0-x86_64.tar.gz
> As there is a valid SSL certificate for downloads.digium.com, should this not use https instead?
> I can see references to other http URLs in the source, so this may apply to other components.
> This was only noticed as a problem where this installation was at a site that does not allow access to public http sites. Manually changing the "remote_url" value in build_tools/download_externals resolved the problem.



--
This message was sent by Atlassian JIRA
(v6.2#6252)