[asterisk-bugs] [JIRA] (ASTERISK-29980) build: External binary modules don't use https
Joshua C. Colp (JIRA)
noreply at issues.asterisk.org
Tue Mar 22 09:01:07 CDT 2022
[ https://issues.asterisk.org/jira/browse/ASTERISK-29980?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Joshua C. Colp updated ASTERISK-29980:
--------------------------------------
Summary: build: External binary modules don't use https (was: Installer uses downloads from insecure URL)
> build: External binary modules don't use https
> ----------------------------------------------
>
> Key: ASTERISK-29980
> URL: https://issues.asterisk.org/jira/browse/ASTERISK-29980
> Project: Asterisk
> Issue Type: Improvement
> Security Level: None
> Components: Codecs/codec_opus, Core/BuildSystem
> Affects Versions: 19.2.1
> Reporter: INVADE International Ltd.
> Labels: security
>
> If we include the OPUS codec as part of an installation, it is sourced as follows:
> codec_opus: Downloading http://downloads.digium.com/pub/telephony/codec_opus/asterisk-19.0/x86-64/codec_opus-19.0_1.3.0-x86_64.tar.gz to /tmp/tmp.MzytcugTdk/codec_opus-19.0_1.3.0-x86_64.tar.gz
> As there is a valid SSL certificate for downloads.digium.com, should this not use https instead?
> I can see references to other http URLs in the source, so this may apply to other components.
> This was only noticed as a problem where this installation was at a site that does not allow access to public http sites. Manually changing the "remote_url" value in build_tools/download_externals resolved the problem.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
More information about the asterisk-bugs
mailing list