mirrors/buildroot
0
0
Fork 0
mirror of https://git.busybox.net/buildroot.git synced 2024-11-26 23:13:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

package/asterisk: security bump to version 16.28.0

Browse Source 
Asterisk 16.26.0 fixed the following security issues:

- [ASTERISK-29476] – res_stir_shaken: Blind SSRF vulnerabilities
  https://issues.asterisk.org/jira/browse/ASTERISK-29476

- [ASTERISK-29838] – ${SQL_ESC()} not correctly escaping a terminating \
  https://issues.asterisk.org/jira/browse/ASTERISK-29838

- [ASTERISK-29872] – res_stir_shaken: Resource exhaustion with large files
  https://issues.asterisk.org/jira/browse/ASTERISK-29872

https://www.asterisk.org/asterisk-news/asterisk-16-26-0-now-available/

It unfortunately also introduced a change to chan_iax2, breaking builds
without OpenSSL:
59a8cdaca2

Which was again fixed in 16.28.0:
f812dfb68c

So bump to 16.28.0:
https://www.asterisk.org/asterisk-news/asterisk-16-28-0-now-available/

The libxml2 support now uses pkg-config, so drop the libxml2-config handling:
bf9dafa7c2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[yann.morin.1998@free.fr:
  - add host-pkgconf dep, don't rely on implicit dep from host-asterisk
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
This commit is contained in:
Peter Korsgaard 2022-11-20 15:17:20 +01:00 committed by Yann E. MORIN
parent e24033f76a
commit bd42aa1d0a
2 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
package/asterisk/asterisk.hash
View File

@ -1,5 +1,5 @@
# Locally computed
sha256 0fb817943a276f5e540c2a9432e8841cd3393e7c1bd1250055c620902f6eafc8 asterisk-16.25.2.tar.gz
sha256 6e9c2f350db018df854b1301687ced8993facb2787698336e55cd19e0ae3ebfe asterisk-16.28.0.tar.gz
# sha1 from: http://downloads.asterisk.org/pub/telephony/sounds/releases
# sha256 locally computed

8
package/asterisk/asterisk.mk
View File

@ -4,7 +4,7 @@
#
################################################################################
ASTERISK_VERSION = 16.25.2
ASTERISK_VERSION = 16.28.0
# Use the github mirror: it's an official mirror maintained by Digium, and
# provides tarballs, which the main Asterisk git tree (behind Gerrit) does not.
ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))
@ -31,6 +31,7 @@ ASTERISK_AUTORECONF_OPTS = -Iautoconf -Ithird-party -Ithird-party/pjproject -Ith
ASTERISK_DEPENDENCIES = \
host-asterisk \
host-pkgconf \
jansson \
libcurl \
libedit \
@ -115,8 +116,7 @@ ASTERISK_CONF_OPTS += --without-avcodec
ASTERISK_CONF_OPTS += --without-spandsp
ASTERISK_CONF_ENV = \
ac_cv_file_bridges_bridge_softmix_include_hrirs_h=true \
ac_cv_path_CONFIG_LIBXML2=$(STAGING_DIR)/usr/bin/xml2-config
ac_cv_file_bridges_bridge_softmix_include_hrirs_h=true
# Uses __atomic_fetch_add_4
ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
@ -314,8 +314,6 @@ HOST_ASTERISK_LICENSE_FILES = COPYING
# so do not inherit the target setup.
HOST_ASTERISK_AUTORECONF = NO
HOST_ASTERISK_CONF_ENV = CONFIG_LIBXML2=$(HOST_DIR)/bin/xml2-config
HOST_ASTERISK_CONF_OPTS = \
--without-newt \
--without-curses \