Re: [Buildroot] [PATCH v2 1/1] package/asterisk: security bump version to 22.5.2

[Waldemar Brodkorb <wbx@openadk.org>]

Hi Thomas,
Thomas Petazzoni via buildroot wrote,

> Hello Bernd,
> 
> On Thu,  6 Nov 2025 21:47:37 +0100
> Bernd Kuhls <bernd@kuhls.net> wrote:
> 
> > Fixes CVE-2025-1131:
> > https://github.com/asterisk/asterisk/security/advisories/GHSA-v9q8-9j8m-5xwp
> > 
> > Acked-by: Titouan Christophe <titouan.christophe@mind.be>
> > Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
> 
> I'm not sure it's been introduced by this version bump, but Asterisk is
> still causing quite a few build failures in the autobuilders.
> 
> I briefly looked into two of them:
> 
> - https://autobuild.buildroot.net/results/426/426336052c50768b06dd047ce4b8283e6da377d4/build-end.log
> 
>   menuselect/menuselect: error while loading shared libraries: libxml2.so.16: cannot open shared object file: No such file or directory
> 
>   The target asterisk package builds "menuselect" as a host tool, but
>   our $(HOST_LDFLAGS) are not passed when building menuselect, so it
>   doesn't have the right -Wl,-rpath flag passed, and therefore when it
>   tries to *run* menuselect, it doesn't find libxml2 in $(HOST_DIR)/lib
> 
>   Not sure how to pass our HOST_LDFLAGS.
> 
>   Also, since it builds menuselect for the host, is it still needed for
>   the target asterisk to depend on host-asterisk ?

The problem here is that somehow newer versions of Asterisk do
trigger sometimes a make clean before the build and then our
host-asterisk mechanism is useless, because menuselect is build
again without our HOST_LDFLAGS. I can reproduce the issue and have a
ugly one-liner patch preventing the cleanup.

Should I sent a patch?

best regards
 Waldemar
 
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot