mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-08 00:20:38 -09:00
84ece21e84
See here for detailed changelog: https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-22.8.2.html Fixes the following CVEs: CVE-2026-23739 / GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42 https://www.cve.org/CVERecord?id=CVE-2026-23739 CVE-2026-23741 / GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3 https://www.cve.org/CVERecord?id=CVE-2026-23741 CVE-2026-23738 / GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh https://www.cve.org/CVERecord?id=CVE-2026-23738 CVE-2026-23740 / GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c https://www.cve.org/CVERecord?id=CVE-2026-23740 Signed-off-by: Waldemar Brodkorb <wbx@openadk.org> [Julien: add CVE details in commit log] Signed-off-by: Julien Olivain <ju.o@free.fr>