From 6add6e3cd87f2ac5c24a558427b8f4aaac6d34a5 Mon Sep 17 00:00:00 2001 From: Waldemar Brodkorb Date: Fri, 29 May 2026 04:52:40 +0200 Subject: [PATCH] package/asterisk: security bump to 22.9.0 See here for a changelog: https://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-22-current.html Pjsip was updated to 2.16. Fixes some security issues in pjsip: Author: Mike Bradeen Date: 2026-03-23 Address the following pjproject security vulnerabilities GHSA-j29p-pvh2-pvqp - Buffer overflow in ICE with long username GHSA-8fj4-fv9f-hjpc - Heap use-after-free in PJSIP presense subscription termination header GHSA-g88q-c2hm-q7p7 - ICE session use-after-free race conditions GHSA-x5pq-qrp4-fmrj - Out-of-bounds read in SIP multipart parsing Signed-off-by: Waldemar Brodkorb Signed-off-by: Peter Korsgaard --- package/asterisk/asterisk.hash | 4 ++-- package/asterisk/asterisk.mk | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package/asterisk/asterisk.hash b/package/asterisk/asterisk.hash index 3a8274b458..8d620a0ee3 100644 --- a/package/asterisk/asterisk.hash +++ b/package/asterisk/asterisk.hash @@ -1,8 +1,8 @@ # Locally computed -sha256 6669a8d2e50481a3b70c6099a21a100ab7d7ae9ac00e2182eabb94c68c94bcc9 asterisk-22.8.2.tar.gz +sha256 dd664a9600874d0b0c0e63a8fda2e08efc9f5fdc95781022fbf39ed9b15196f6 asterisk-22.9.0.tar.gz # Locally computed -sha256 58bb83cec4d431f48d006e455d821668450f8cf6b6c95f090def47062fa3a60c pjproject-2.15.1.tar.bz2 +sha256 633c3dc34ffb21af8ac9ee160245c9c174379391e35cace1b6c9f516a260f683 pjproject-2.16.tar.bz2 sha256 6775095bcd417d375faddc1f17cdd7706ad8aa9b9b02404990c4b0ee218ee379 libjwt-1.15.3.tar.gz # sha1 from: http://downloads.asterisk.org/pub/telephony/sounds/releases diff --git a/package/asterisk/asterisk.mk b/package/asterisk/asterisk.mk index e2fdb189fa..b15a83f6f8 100644 --- a/package/asterisk/asterisk.mk +++ b/package/asterisk/asterisk.mk @@ -4,7 +4,7 @@ # ################################################################################ -ASTERISK_VERSION = 22.8.2 +ASTERISK_VERSION = 22.9.0 # Use the github mirror: it's an official mirror maintained by Digium, and # provides tarballs, which the main Asterisk git tree (behind Gerrit) does not. ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION)) @@ -12,13 +12,13 @@ ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION)) # compilation with the external pjsip produces a non-working asterisk, which # segfaults. The reason behind this is unclear. # https://github.com/asterisk/asterisk/issues/671 -ASTERISK_PJSIP_URL = https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.15.1/ +ASTERISK_PJSIP_URL = https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.16/ ASTERISK_LIBJWT_URL = https://raw.githubusercontent.com/asterisk/third-party/master/libjwt/1.15.3/ ASTERISK_SOUNDS_BASE_URL = http://downloads.asterisk.org/pub/telephony/sounds/releases ASTERISK_EXTRA_DOWNLOADS = \ $(ASTERISK_SOUNDS_BASE_URL)/asterisk-core-sounds-en-gsm-1.6.1.tar.gz \ $(ASTERISK_SOUNDS_BASE_URL)/asterisk-moh-opsound-wav-2.03.tar.gz \ - $(ASTERISK_PJSIP_URL)/pjproject-2.15.1.tar.bz2 \ + $(ASTERISK_PJSIP_URL)/pjproject-2.16.tar.bz2 \ $(ASTERISK_LIBJWT_URL)/libjwt-1.15.3.tar.gz ASTERISK_LICENSE = GPL-2.0, BSD-3-Clause (SHA1, resample), BSD-4-Clause (db1-ast)