From nobody Sun Feb 22 21:55:23 2026 X-Original-To: ports-bugs@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4fJyTS0Nz1z6S6sD for ; Sun, 22 Feb 2026 21:55:24 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4fJyTR73Dzz3YD4 for ; Sun, 22 Feb 2026 21:55:23 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1771797324; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pb1x3uI3iasoLfePa/PG0FwHxjZW2p05dFDlgCHTzdY=; b=ZCq3ZzchIrKD4FVvaDn3SaDeUg5VGkGDhMCISMZg4GoL73pk+7Ijk/Ap5j8NHu8d8eWwzP YOY0dU0AzbvN7kfD8dQT2HFKO2R5u/v4QcNZK5DDzMCmBFw5AsqCZKmi1+7YLlbPUT/3CJ 5rs0XzBWQFfqHlku+8BaEj59g7SCX1h4prgwQh+HGGr1ydFC5uZyKuH5Ld6wcxO9AAK3O2 zIspJcBWxqYj/BXDX7QWpM4mOvpMIbzRSKnIR6WP3BUIexlLwi8WyvAbm5dsXf9D6zT3yi SydTJD616PQN3UdbL5RbL1j2Y0QcFmGsKlRSMkMHZKmMdKH0HPryt4d4kfAzyw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1771797324; a=rsa-sha256; cv=none; b=MU+SSA2roOEhDPZHIySZcmpn5hQW4b5tXe2nKRawbnvXVkkDyJkTveqOzcDXrPNbbLJqQy XZQ9ZFPSWegeHdPvSjtK6jcMcbB5wd467lRYGp56LSqTzrI/wTB/Muphmb/XrgizwCmGrs XQ9/TBKoloL0PdZucwI6k2bNCn4eSPNGGY1ZExiYiLAXElo9idqQRIEnfmqnGUBbfeEKrj YjA15xGP56CuUhv5pSMG7Rpf0qeVnw56boHd+9m3z72r9Eyeu7LBKm9PRkh+0I4aKLm1iw 70sy9eD3DgiGj+hDTBrTQd9pRa8MUBF4704nSCwRA9pUOnBaj+SjAnm/Sc3S7A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1771797324; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pb1x3uI3iasoLfePa/PG0FwHxjZW2p05dFDlgCHTzdY=; b=ySueCtfx1GIHnZy3O3EsfhBPDdhNA9LV9NdSh1j4UaE8H8OV4c/bdaDRvoOk8wl1+mafmk TxYuqCzHEvD5+kVo16P6D12AUuzpKo7bc8XtzRKu2AxaMQ884xMxYtakV7uWwu6f2WRMzX QQDB4jLb2zD+UtY9Kzqt9OqLIbu9rfgOHbdSBI1bSb2VX4MVSWdvM+jYPzFLY7ySnikAM7 BnXFm5OUN8nCuPA4KFV1DZNZn+AwGlCzjL4+RHMu7vOM0FX4xZ9gYA3FRVUyXT+8O8JDzi hYoWZegOrPkmv6NTPqPB9xKeeQkpGQqRRE3Ai/DMfbOv8/rqi6LZLEbH2du+Uw== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4fJyTR6bVgz12WY for ; Sun, 22 Feb 2026 21:55:23 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 61MLtNS1010643 for ; Sun, 22 Feb 2026 21:55:23 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from bugzilla@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 61MLtNhP010639 for ports-bugs@FreeBSD.org; Sun, 22 Feb 2026 21:55:23 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: bugzilla set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: ports-bugs@FreeBSD.org Subject: [Bug 293361] net/asterisk2{0,2} updates Date: Sun, 22 Feb 2026 21:55:23 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Ports & Packages X-Bugzilla-Component: Individual Port(s) X-Bugzilla-Version: Latest X-Bugzilla-Keywords: X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: commit-hook@FreeBSD.org X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: ports-bugs@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback+ merge-quarterly? X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Ports bug reports List-Archive: https://lists.freebsd.org/archives/freebsd-ports-bugs List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-ports-bugs@freebsd.org Sender: owner-freebsd-ports-bugs@FreeBSD.org MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D293361 --- Comment #11 from commit-hook@FreeBSD.org --- A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=3Dab05146a6f7ec39a268ac534831bb1f= b5dab0dee commit ab05146a6f7ec39a268ac534831bb1fb5dab0dee Author: Marek Zarychta AuthorDate: 2026-02-22 21:53:33 +0000 Commit: Vladimir Druzenko CommitDate: 2026-02-22 21:53:33 +0000 net/asterisk22: Update 20.18.1 =3D> 20.18.2 Security Advisories Resolved: 4 - GHSA-85x7-54wr-vh42: Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection. - GHSA-rvch-3jmx-3jf3: ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation. - GHSA-v6hp-wh3r-cwxh: The Asterisk embedded web server's /httpstatus page echos user supplied values(cookie and query string) without sanitization. - GHSA-xpc6-x892-v83c: ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation. Changelog: =20=20=20 https://downloads.asterisk.org/pub/telephony/asterisk/old-releases/ChangeLo= g-20.18.2.html PR: 293361 Approved by: Oleksandr Kryvulia Security: GHSA-85x7-54wr-vh42 Security: GHSA-rvch-3jmx-3jf3 Security: GHSA-v6hp-wh3r-cwxh Security: GHSA-xpc6-x892-v83c MFH: 2026Q1 net/asterisk20/Makefile | 2 +- net/asterisk20/distinfo | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) --=20 You are receiving this mail because: You are the assignee for the bug.=