From dd4e9cae2615071de98c17fe04ac93b3609f86ba Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Thu, 6 Nov 2025 21:47:37 +0100 Subject: [PATCH] package/asterisk: security bump version to 22.5.2 Fixes the following security issues: - CVE-2025-1131: Uncontrolled Search-Path Element in safe_asterisk script may allow local privilege escalation https://github.com/asterisk/asterisk/security/advisories/GHSA-v9q8-9j8m-5xwp - CVE-2025-57767: A specifically malformed Authorization header in an incoming SIP request can cause Asterisk to crash https://github.com/asterisk/asterisk/security/advisories/GHSA-64qc-9x89-rx5j - CVE-2025-49832: Remote DoS and possible RCE in asterisk/res/res_stir_shaken/verification.c https://github.com/asterisk/asterisk/security/advisories/GHSA-mrq5-74j5-f5cr - CVE-2025-47780: cli_permissions.conf: deny option does not work for disallowing shell commands https://github.com/asterisk/asterisk/security/advisories/GHSA-c7p6-7mvq-8jq2 - CVE-2025-47779: Using malformed From header can forge identity with ";" or NULL in name portion https://github.com/asterisk/asterisk/security/advisories/GHSA-2grh-7mhv-fcfw Signed-off-by: Bernd Kuhls Acked-by: Titouan Christophe [Peter: add additional CVEs] Signed-off-by: Peter Korsgaard (cherry picked from commit 02fd1d2b9347131ee2ceaae80d1cd5f6e962f09a) Signed-off-by: Thomas Perale --- package/asterisk/asterisk.hash | 2 +- package/asterisk/asterisk.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/asterisk/asterisk.hash b/package/asterisk/asterisk.hash index 7b28624921..c09a5bc183 100644 --- a/package/asterisk/asterisk.hash +++ b/package/asterisk/asterisk.hash @@ -1,5 +1,5 @@ # Locally computed -sha256 4cc403c8885d4aed3956dfb75d315d3e5bcc129eb9cd47c156d3b12ecceed1ba asterisk-22.3.0.tar.gz +sha256 8a94650b6f348af1f1c9cce7ed3585d280f3a31b0d3820084a42b03712df95d5 asterisk-22.5.2.tar.gz # Locally computed sha256 58bb83cec4d431f48d006e455d821668450f8cf6b6c95f090def47062fa3a60c pjproject-2.15.1.tar.bz2 diff --git a/package/asterisk/asterisk.mk b/package/asterisk/asterisk.mk index 18af217129..0d40ebf2b4 100644 --- a/package/asterisk/asterisk.mk +++ b/package/asterisk/asterisk.mk @@ -4,7 +4,7 @@ # ################################################################################ -ASTERISK_VERSION = 22.3.0 +ASTERISK_VERSION = 22.5.2 # Use the github mirror: it's an official mirror maintained by Digium, and # provides tarballs, which the main Asterisk git tree (behind Gerrit) does not. ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))