mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/asterisk: security bump to 22.8.2

Browse Source 
See here for detailed changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-22.8.2.html

Fixes the following CVEs:

CVE-2026-23739 / GHSA-85x7-54wr-vh42:
Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential
XXE Injection
https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42
https://www.cve.org/CVERecord?id=CVE-2026-23739

CVE-2026-23741 / GHSA-rvch-3jmx-3jf3:
ast_coredumper running as root sources ast_debug_tools.conf from
/etc/asterisk; potentially leading to privilege escalation
https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3
https://www.cve.org/CVERecord?id=CVE-2026-23741

CVE-2026-23738 / GHSA-v6hp-wh3r-cwxh:
The Asterisk embedded web server's /httpstatus page echos user
supplied values(cookie and query string) without sanitization
https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh
https://www.cve.org/CVERecord?id=CVE-2026-23738

CVE-2026-23740 / GHSA-xpc6-x892-v83c:
ast_coredumper runs as root, and writes gdb init file to world
writeable folder; leading to potential privilege escalation
https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c
https://www.cve.org/CVERecord?id=CVE-2026-23740

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Julien: add CVE details in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 84ece21e84)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Waldemar Brodkorb
2026-03-23 08:42:55 +01:00
committed by Thomas Perale
parent 731cc7e2a3
commit 03ef4770e4
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package/asterisk/asterisk.hash
View File

@@ -1,5 +1,5 @@
# Locally computed
sha256 4f30af0695a0131fc091d85e7b91e22504609434b3fbd263898c7354d41959c9 asterisk-22.8.1.tar.gz
sha256 6669a8d2e50481a3b70c6099a21a100ab7d7ae9ac00e2182eabb94c68c94bcc9 asterisk-22.8.2.tar.gz
# Locally computed
sha256 58bb83cec4d431f48d006e455d821668450f8cf6b6c95f090def47062fa3a60c pjproject-2.15.1.tar.bz2

2
package/asterisk/asterisk.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
ASTERISK_VERSION = 22.8.1
ASTERISK_VERSION = 22.8.2
# Use the github mirror: it's an official mirror maintained by Digium, and
# provides tarballs, which the main Asterisk git tree (behind Gerrit) does not.
ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))