[Buildroot] [PATCH v2 1/1] package/asterisk: security bump version to 22.5.2

[Buildroot] [PATCH v2 1/1] package/asterisk: security bump version to 22.5.2

[Bernd Kuhls]

Fixes CVE-2025-1131:
https://github.com/asterisk/asterisk/security/advisories/GHSA-v9q8-9j8m-5xwp

Acked-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
v2: updated subject to reflect that this is a security bump (Titouan)

 package/asterisk/asterisk.hash | 2 +-
 package/asterisk/asterisk.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/asterisk/asterisk.hash b/package/asterisk/asterisk.hash
index f11ed08ef4..26175667c3 100644
--- a/package/asterisk/asterisk.hash
+++ b/package/asterisk/asterisk.hash
@@ -1,5 +1,5 @@
 # Locally computed
-sha256  4cc403c8885d4aed3956dfb75d315d3e5bcc129eb9cd47c156d3b12ecceed1ba  asterisk-22.3.0.tar.gz
+sha256  8a94650b6f348af1f1c9cce7ed3585d280f3a31b0d3820084a42b03712df95d5  asterisk-22.5.2.tar.gz
 
 # Locally computed
 sha256  58bb83cec4d431f48d006e455d821668450f8cf6b6c95f090def47062fa3a60c  pjproject-2.15.1.tar.bz2
diff --git a/package/asterisk/asterisk.mk b/package/asterisk/asterisk.mk
index e7e802aa45..9a071fb8e0 100644
--- a/package/asterisk/asterisk.mk
+++ b/package/asterisk/asterisk.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-ASTERISK_VERSION = 22.3.0
+ASTERISK_VERSION = 22.5.2
 # Use the github mirror: it's an official mirror maintained by Digium, and
 # provides tarballs, which the main Asterisk git tree (behind Gerrit) does not.
 ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 1/1] package/asterisk: security bump version to 22.5.2

[Peter Korsgaard]

>>>>> "Bernd" == Bernd Kuhls <bernd@kuhls.net> writes:

 > Fixes CVE-2025-1131:
 > https://github.com/asterisk/asterisk/security/advisories/GHSA-v9q8-9j8m-5xwp

From the advisories page it looks as if (at least) CVE-2025-57767,
CVE-2025-49832, CVE-2025-47780 and CVE-2025-47779 are also fixed since
22.3.0, so I have updated the commit message and applied - Thanks.


 > Acked-by: Titouan Christophe <titouan.christophe@mind.be>
 > Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
 > ---
 > v2: updated subject to reflect that this is a security bump (Titouan)

 >  package/asterisk/asterisk.hash | 2 +-
 >  package/asterisk/asterisk.mk   | 2 +-
 >  2 files changed, 2 insertions(+), 2 deletions(-)

 > diff --git a/package/asterisk/asterisk.hash b/package/asterisk/asterisk.hash
 > index f11ed08ef4..26175667c3 100644
 > --- a/package/asterisk/asterisk.hash
 > +++ b/package/asterisk/asterisk.hash
 > @@ -1,5 +1,5 @@
 >  # Locally computed
 > -sha256  4cc403c8885d4aed3956dfb75d315d3e5bcc129eb9cd47c156d3b12ecceed1ba  asterisk-22.3.0.tar.gz
 > +sha256  8a94650b6f348af1f1c9cce7ed3585d280f3a31b0d3820084a42b03712df95d5  asterisk-22.5.2.tar.gz
 
 >  # Locally computed
 >  sha256  58bb83cec4d431f48d006e455d821668450f8cf6b6c95f090def47062fa3a60c  pjproject-2.15.1.tar.bz2
 > diff --git a/package/asterisk/asterisk.mk b/package/asterisk/asterisk.mk
 > index e7e802aa45..9a071fb8e0 100644
 > --- a/package/asterisk/asterisk.mk
 > +++ b/package/asterisk/asterisk.mk
 > @@ -4,7 +4,7 @@
 >  #
 >  ################################################################################
 
 > -ASTERISK_VERSION = 22.3.0
 > +ASTERISK_VERSION = 22.5.2
 >  # Use the github mirror: it's an official mirror maintained by Digium, and
 >  # provides tarballs, which the main Asterisk git tree (behind Gerrit) does not.
 >  ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))
 > -- 

 > 2.47.3

 > _______________________________________________
 > buildroot mailing list
 > buildroot@buildroot.org
 > https://lists.buildroot.org/mailman/listinfo/buildroot


-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 1/1] package/asterisk: security bump version to 22.5.2

[Arnout Vandecappelle via buildroot]

On 06/11/2025 21:47, Bernd Kuhls wrote:
> Fixes CVE-2025-1131:
> https://github.com/asterisk/asterisk/security/advisories/GHSA-v9q8-9j8m-5xwp
> 
> Acked-by: Titouan Christophe <titouan.christophe@mind.be>
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

  Applied to 2025.02.x and 2025.08.x, thanks.

  Regards,
  Arnout

> ---
> v2: updated subject to reflect that this is a security bump (Titouan)
> 
>   package/asterisk/asterisk.hash | 2 +-
>   package/asterisk/asterisk.mk   | 2 +-
>   2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/package/asterisk/asterisk.hash b/package/asterisk/asterisk.hash
> index f11ed08ef4..26175667c3 100644
> --- a/package/asterisk/asterisk.hash
> +++ b/package/asterisk/asterisk.hash
> @@ -1,5 +1,5 @@
>   # Locally computed
> -sha256  4cc403c8885d4aed3956dfb75d315d3e5bcc129eb9cd47c156d3b12ecceed1ba  asterisk-22.3.0.tar.gz
> +sha256  8a94650b6f348af1f1c9cce7ed3585d280f3a31b0d3820084a42b03712df95d5  asterisk-22.5.2.tar.gz
>   
>   # Locally computed
>   sha256  58bb83cec4d431f48d006e455d821668450f8cf6b6c95f090def47062fa3a60c  pjproject-2.15.1.tar.bz2
> diff --git a/package/asterisk/asterisk.mk b/package/asterisk/asterisk.mk
> index e7e802aa45..9a071fb8e0 100644
> --- a/package/asterisk/asterisk.mk
> +++ b/package/asterisk/asterisk.mk
> @@ -4,7 +4,7 @@
>   #
>   ################################################################################
>   
> -ASTERISK_VERSION = 22.3.0
> +ASTERISK_VERSION = 22.5.2
>   # Use the github mirror: it's an official mirror maintained by Digium, and
>   # provides tarballs, which the main Asterisk git tree (behind Gerrit) does not.
>   ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 1/1] package/asterisk: security bump version to 22.5.2

[Thomas Petazzoni via buildroot]

Hello Bernd,

On Thu,  6 Nov 2025 21:47:37 +0100
Bernd Kuhls <bernd@kuhls.net> wrote:

> Fixes CVE-2025-1131:
> https://github.com/asterisk/asterisk/security/advisories/GHSA-v9q8-9j8m-5xwp
> 
> Acked-by: Titouan Christophe <titouan.christophe@mind.be>
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

I'm not sure it's been introduced by this version bump, but Asterisk is
still causing quite a few build failures in the autobuilders.

I briefly looked into two of them:

- https://autobuild.buildroot.net/results/426/426336052c50768b06dd047ce4b8283e6da377d4/build-end.log

  menuselect/menuselect: error while loading shared libraries: libxml2.so.16: cannot open shared object file: No such file or directory

  The target asterisk package builds "menuselect" as a host tool, but
  our $(HOST_LDFLAGS) are not passed when building menuselect, so it
  doesn't have the right -Wl,-rpath flag passed, and therefore when it
  tries to *run* menuselect, it doesn't find libxml2 in $(HOST_DIR)/lib

  Not sure how to pass our HOST_LDFLAGS.

  Also, since it builds menuselect for the host, is it still needed for
  the target asterisk to depend on host-asterisk ?

- https://autobuild.buildroot.net/results/af9/af9c127965260044095f1fa98db88e1d1d762646/build-end.log

  Invalid configuration `or1k-buildroot-linux-gnu': machine `or1k-buildroot' not recognized

  The config.sub part of the pjsip code (downloaded as EXTRA_DOWNLOADS)
  is very old, and doesn't know about or1k. It would have to be
  overridden by our copy in support/gnuconfig/ (also config.guess).

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 1/1] package/asterisk: security bump version to 22.5.2

[Waldemar Brodkorb]

Hi Thomas,
Thomas Petazzoni via buildroot wrote,

> Hello Bernd,
> 
> On Thu,  6 Nov 2025 21:47:37 +0100
> Bernd Kuhls <bernd@kuhls.net> wrote:
> 
> > Fixes CVE-2025-1131:
> > https://github.com/asterisk/asterisk/security/advisories/GHSA-v9q8-9j8m-5xwp
> > 
> > Acked-by: Titouan Christophe <titouan.christophe@mind.be>
> > Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
> 
> I'm not sure it's been introduced by this version bump, but Asterisk is
> still causing quite a few build failures in the autobuilders.
> 
> I briefly looked into two of them:
> 
> - https://autobuild.buildroot.net/results/426/426336052c50768b06dd047ce4b8283e6da377d4/build-end.log
> 
>   menuselect/menuselect: error while loading shared libraries: libxml2.so.16: cannot open shared object file: No such file or directory
> 
>   The target asterisk package builds "menuselect" as a host tool, but
>   our $(HOST_LDFLAGS) are not passed when building menuselect, so it
>   doesn't have the right -Wl,-rpath flag passed, and therefore when it
>   tries to *run* menuselect, it doesn't find libxml2 in $(HOST_DIR)/lib
> 
>   Not sure how to pass our HOST_LDFLAGS.
> 
>   Also, since it builds menuselect for the host, is it still needed for
>   the target asterisk to depend on host-asterisk ?

The problem here is that somehow newer versions of Asterisk do
trigger sometimes a make clean before the build and then our
host-asterisk mechanism is useless, because menuselect is build
again without our HOST_LDFLAGS. I can reproduce the issue and have a
ugly one-liner patch preventing the cleanup.

Should I sent a patch?

best regards
 Waldemar
 
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot