From 03ef4770e4131b77b4fa5c286805972aa670f4d5 Mon Sep 17 00:00:00 2001 From: Waldemar Brodkorb Date: Mon, 23 Mar 2026 08:42:55 +0100 Subject: [PATCH] package/asterisk: security bump to 22.8.2 See here for detailed changelog: https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-22.8.2.html Fixes the following CVEs: CVE-2026-23739 / GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42 https://www.cve.org/CVERecord?id=CVE-2026-23739 CVE-2026-23741 / GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3 https://www.cve.org/CVERecord?id=CVE-2026-23741 CVE-2026-23738 / GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh https://www.cve.org/CVERecord?id=CVE-2026-23738 CVE-2026-23740 / GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c https://www.cve.org/CVERecord?id=CVE-2026-23740 Signed-off-by: Waldemar Brodkorb [Julien: add CVE details in commit log] Signed-off-by: Julien Olivain (cherry picked from commit 84ece21e8482c98fc4d21f3a791cb516118bc169) Signed-off-by: Thomas Perale --- package/asterisk/asterisk.hash | 2 +- package/asterisk/asterisk.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/asterisk/asterisk.hash b/package/asterisk/asterisk.hash index f1573f6575..3a8274b458 100644 --- a/package/asterisk/asterisk.hash +++ b/package/asterisk/asterisk.hash @@ -1,5 +1,5 @@ # Locally computed -sha256 4f30af0695a0131fc091d85e7b91e22504609434b3fbd263898c7354d41959c9 asterisk-22.8.1.tar.gz +sha256 6669a8d2e50481a3b70c6099a21a100ab7d7ae9ac00e2182eabb94c68c94bcc9 asterisk-22.8.2.tar.gz # Locally computed sha256 58bb83cec4d431f48d006e455d821668450f8cf6b6c95f090def47062fa3a60c pjproject-2.15.1.tar.bz2 diff --git a/package/asterisk/asterisk.mk b/package/asterisk/asterisk.mk index b59f2bf5aa..e2fdb189fa 100644 --- a/package/asterisk/asterisk.mk +++ b/package/asterisk/asterisk.mk @@ -4,7 +4,7 @@ # ################################################################################ -ASTERISK_VERSION = 22.8.1 +ASTERISK_VERSION = 22.8.2 # Use the github mirror: it's an official mirror maintained by Digium, and # provides tarballs, which the main Asterisk git tree (behind Gerrit) does not. ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))