Change log : frr package : Ubuntu

8.4.4-1.1ubuntu6

Published in oracular-release on 2024-04-29

Published in noble-release on 2024-04-18

Deleted in noble-proposed (Reason: Moved to noble)

frr (8.4.4-1.1ubuntu6) noble; urgency=medium

  * No-change rebuild for c-ares t64.

 -- Matthias Klose <email address hidden>  Tue, 16 Apr 2024 11:56:13 +0200

Available diffs

diff from 8.4.4-1.1ubuntu5 to 8.4.4-1.1ubuntu6 (302 bytes)

8.4.4-1.1ubuntu5

Superseded in noble-release on 2024-04-18

Deleted in noble-proposed on 2024-04-19 (Reason: Moved to noble)

frr (8.4.4-1.1ubuntu5) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <email address hidden>  Sun, 31 Mar 2024 05:25:32 +0000

Available diffs

diff from 8.4.4-1.1ubuntu4 to 8.4.4-1.1ubuntu5 (333 bytes)

8.1-1ubuntu1.9

Published in jammy-updates on 2024-03-06

Published in jammy-security on 2024-03-06

frr (8.1-1ubuntu1.9) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS via malformed OSPF LSA packet
    - debian/patches/CVE-2024-27913.patch: solved crash in OSPF TE parsing
      in ospfd/ospf_te.c.
    - CVE-2024-27913

 -- Marc Deslauriers <email address hidden>  Tue, 05 Mar 2024 08:27:58 -0500

Available diffs

diff from 8.1-1ubuntu1.8 to 8.1-1ubuntu1.9 (1.2 KiB)

8.4.4-1.1ubuntu4

Superseded in noble-release on 2024-04-04

Deleted in noble-proposed on 2024-04-05 (Reason: Moved to noble)

frr (8.4.4-1.1ubuntu4) noble; urgency=medium

  * SECURITY UPDATE: DoS via malformed OSPF LSA packet
    - debian/patches/CVE-2024-27913.patch: solved crash in OSPF TE parsing
      in ospfd/ospf_te.c.
    - CVE-2024-27913

 -- Marc Deslauriers <email address hidden>  Tue, 05 Mar 2024 08:25:28 -0500

Available diffs

diff from 8.4.4-1.1ubuntu3 to 8.4.4-1.1ubuntu4 (1.2 KiB)

8.4.4-1.1ubuntu1.3

Published in mantic-updates on 2024-03-06

Published in mantic-security on 2024-03-06

frr (8.4.4-1.1ubuntu1.3) mantic-security; urgency=medium

  * SECURITY UPDATE: DoS via malformed OSPF LSA packet
    - debian/patches/CVE-2024-27913.patch: solved crash in OSPF TE parsing
      in ospfd/ospf_te.c.
    - CVE-2024-27913

 -- Marc Deslauriers <email address hidden>  Tue, 05 Mar 2024 08:27:21 -0500

Available diffs

diff from 8.4.4-1.1ubuntu1.2 to 8.4.4-1.1ubuntu1.3 (1.2 KiB)

8.1-1ubuntu1.8

Superseded in jammy-updates on 2024-03-06

Superseded in jammy-security on 2024-03-06

frr (8.1-1ubuntu1.8) jammy-security; urgency=medium

  * SECURITY UPDATE: flowspec overflow issue
    - debian/patches/CVE-2023-38406.patch: check length in
      bgpd/bgp_flowspec.c.
    - CVE-2023-38406
  * SECURITY UPDATE: read beyond stream during labeled unicast parsing
    - debian/patches/CVE-2023-38407.patch: fix use beyond end of stream of
      labeled unicast parsing in bgpd/bgp_label.c.
    - CVE-2023-38407
  * SECURITY UPDATE: crash via MP_UNREACH_NLRI attribute
    - debian/patches/CVE-2023-47234.patch: ignore handling NLRIs if we
      received MP_UNREACH_NLRI in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-47234
  * SECURITY UPDATE: crash via malformed BGP UPDATE message
    - debian/patches/CVE-2023-47235.patch: treat EOR as withdrawn to avoid
      unwanted handling of malformed attrs in bgpd/bgp_attr.c.
    - CVE-2023-47235

 -- Marc Deslauriers <email address hidden>  Thu, 16 Nov 2023 09:48:20 -0500

Available diffs

diff from 8.1-1ubuntu1.7 to 8.1-1ubuntu1.8 (4.1 KiB)

8.4.2-1ubuntu1.6

Published in lunar-updates on 2023-11-21

Published in lunar-security on 2023-11-21

frr (8.4.2-1ubuntu1.6) lunar-security; urgency=medium

  * SECURITY UPDATE: flowspec overflow issue
    - debian/patches/CVE-2023-38406.patch: check length in
      bgpd/bgp_flowspec.c.
    - CVE-2023-38406
  * SECURITY UPDATE: read beyond stream during labeled unicast parsing
    - debian/patches/CVE-2023-38407.patch: fix use beyond end of stream of
      labeled unicast parsing in bgpd/bgp_label.c.
    - CVE-2023-38407
  * SECURITY UPDATE: crash via MP_UNREACH_NLRI attribute
    - debian/patches/CVE-2023-47234.patch: ignore handling NLRIs if we
      received MP_UNREACH_NLRI in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-47234
  * SECURITY UPDATE: crash via malformed BGP UPDATE message
    - debian/patches/CVE-2023-47235.patch: treat EOR as withdrawn to avoid
      unwanted handling of malformed attrs in bgpd/bgp_attr.c.
    - CVE-2023-47235

 -- Marc Deslauriers <email address hidden>  Thu, 16 Nov 2023 09:45:05 -0500

Available diffs

diff from 8.4.2-1ubuntu1.5 to 8.4.2-1ubuntu1.6 (4.2 KiB)

8.4.4-1.1ubuntu1.2

Superseded in mantic-updates on 2024-03-06

Superseded in mantic-security on 2024-03-06

frr (8.4.4-1.1ubuntu1.2) mantic-security; urgency=medium

  * SECURITY UPDATE: read beyond stream during labeled unicast parsing
    - debian/patches/CVE-2023-38407.patch: fix use beyond end of stream of
      labeled unicast parsing in bgpd/bgp_label.c.
    - CVE-2023-38407
  * SECURITY UPDATE: crash via MP_UNREACH_NLRI attribute
    - debian/patches/CVE-2023-47234.patch: ignore handling NLRIs if we
      received MP_UNREACH_NLRI in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-47234
  * SECURITY UPDATE: crash via malformed BGP UPDATE message
    - debian/patches/CVE-2023-47235.patch: treat EOR as withdrawn to avoid
      unwanted handling of malformed attrs in bgpd/bgp_attr.c.
    - CVE-2023-47235

 -- Marc Deslauriers <email address hidden>  Thu, 16 Nov 2023 09:43:59 -0500

Available diffs

diff from 8.4.4-1.1ubuntu1.1 to 8.4.4-1.1ubuntu1.2 (3.7 KiB)

8.4.4-1.1ubuntu3

Deleted in noble-updates on 2024-04-06 (Reason: superseded by release)

Superseded in noble-release on 2024-03-29

Deleted in noble-proposed on 2024-04-06 (Reason: Moved to noble)

frr (8.4.4-1.1ubuntu3) noble; urgency=medium

  * SECURITY UPDATE: read beyond stream during labeled unicast parsing
    - debian/patches/CVE-2023-38407.patch: fix use beyond end of stream of
      labeled unicast parsing in bgpd/bgp_label.c.
    - CVE-2023-38407
  * SECURITY UPDATE: crash via MP_UNREACH_NLRI attribute
    - debian/patches/CVE-2023-47234.patch: ignore handling NLRIs if we
      received MP_UNREACH_NLRI in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-47234
  * SECURITY UPDATE: crash via malformed BGP UPDATE message
    - debian/patches/CVE-2023-47235.patch: treat EOR as withdrawn to avoid
      unwanted handling of malformed attrs in bgpd/bgp_attr.c.
    - CVE-2023-47235

 -- Marc Deslauriers <email address hidden>  Thu, 16 Nov 2023 09:19:43 -0500

Available diffs

diff from 8.4.4-1.1ubuntu1 to 8.4.4-1.1ubuntu3 (5.8 KiB)
diff from 8.4.4-1.1ubuntu2 to 8.4.4-1.1ubuntu3 (3.7 KiB)

8.4.4-1.1ubuntu2

Superseded in noble-proposed on 2023-11-16

frr (8.4.4-1.1ubuntu2) noble; urgency=medium

  * SECURITY UPDATE: DoS via MP_REACH_NLRI data
    - debian/patches/CVE-2023-46752.patch: handle MP_REACH_NLRI malformed
      packets with session reset in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-46752
  * SECURITY UPDATE: DoS via BGP UPDATE without mandatory attributes
    - debian/patches/CVE-2023-46753.patch: check mandatory attributes more
      carefully for UPDATE message in bgpd/bgp_attr.c.
    - CVE-2023-46753

 -- Marc Deslauriers <email address hidden>  Wed, 01 Nov 2023 14:12:59 -0400

Available diffs

diff from 8.4.4-1.1ubuntu1 to 8.4.4-1.1ubuntu2 (3.6 KiB)

8.1-1ubuntu1.7

Superseded in jammy-updates on 2023-11-21

Superseded in jammy-security on 2023-11-21

frr (8.1-1ubuntu1.7) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS via MP_REACH_NLRI data
    - debian/patches/CVE-2023-46752.patch: handle MP_REACH_NLRI malformed
      packets with session reset in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-46752
  * SECURITY UPDATE: DoS via BGP UPDATE without mandatory attributes
    - debian/patches/CVE-2023-46753.patch: check mandatory attributes more
      carefully for UPDATE message in bgpd/bgp_attr.c.
    - CVE-2023-46753

 -- Marc Deslauriers <email address hidden>  Wed, 01 Nov 2023 14:30:38 -0400

Available diffs

diff from 8.1-1ubuntu1.6 to 8.1-1ubuntu1.7 (3.6 KiB)

8.4.2-1ubuntu1.5

Superseded in lunar-updates on 2023-11-21

Superseded in lunar-security on 2023-11-21

frr (8.4.2-1ubuntu1.5) lunar-security; urgency=medium

  * SECURITY UPDATE: DoS via MP_REACH_NLRI data
    - debian/patches/CVE-2023-46752.patch: handle MP_REACH_NLRI malformed
      packets with session reset in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-46752
  * SECURITY UPDATE: DoS via BGP UPDATE without mandatory attributes
    - debian/patches/CVE-2023-46753.patch: check mandatory attributes more
      carefully for UPDATE message in bgpd/bgp_attr.c.
    - CVE-2023-46753

 -- Marc Deslauriers <email address hidden>  Wed, 01 Nov 2023 14:27:47 -0400

Available diffs

8.4.4-1.1ubuntu1.1

Superseded in mantic-updates on 2023-11-21

Superseded in mantic-security on 2023-11-21

frr (8.4.4-1.1ubuntu1.1) mantic-security; urgency=medium

  * SECURITY UPDATE: DoS via MP_REACH_NLRI data
    - debian/patches/CVE-2023-46752.patch: handle MP_REACH_NLRI malformed
      packets with session reset in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-46752
  * SECURITY UPDATE: DoS via BGP UPDATE without mandatory attributes
    - debian/patches/CVE-2023-46753.patch: check mandatory attributes more
      carefully for UPDATE message in bgpd/bgp_attr.c.
    - CVE-2023-46753

 -- Marc Deslauriers <email address hidden>  Wed, 01 Nov 2023 14:12:59 -0400

Available diffs

diff from 8.4.4-1.1ubuntu1 (in Ubuntu) to 8.4.4-1.1ubuntu1.1 (3.6 KiB)

8.4.2-1ubuntu1.4

Superseded in lunar-updates on 2023-11-15

Superseded in lunar-security on 2023-11-15

frr (8.4.2-1ubuntu1.4) lunar-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2023-41358.patch: Do not process NLRIs if the
      attribute length is zero
    - debian/patches/CVE-2023-41360.patch: Don't read the first byte of ORF
      header if we are ahead of stream
    - CVE-2023-41358
    - CVE-2023-41360
  * SECURITY UPDATE: Null pointer dereference
    - debian/patches/CVE-2023-41909.patch: Limit flowspec to no attribute
      means a implicit withdrawal
    - CVE-2023-41909

 -- Nishit Majithia <email address hidden>  Mon, 16 Oct 2023 12:27:34 +0530

Available diffs

8.1-1ubuntu1.6

Superseded in jammy-updates on 2023-11-15

Superseded in jammy-security on 2023-11-15

frr (8.1-1ubuntu1.6) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2023-41358.patch: Do not process NLRIs if the
      attribute length is zero
    - debian/patches/CVE-2023-41360.patch: Don't read the first byte of ORF
      header if we are ahead of stream
    - CVE-2023-41358
    - CVE-2023-41360
  * SECURITY UPDATE: Null pointer dereference
    - debian/patches/CVE-2023-41909.patch: Limit flowspec to no attribute
      means a implicit withdrawal
    - CVE-2023-41909

 -- Nishit Majithia <email address hidden>  Mon, 16 Oct 2023 13:03:51 +0530

Available diffs

diff from 8.1-1ubuntu1.5 to 8.1-1ubuntu1.6 (3.3 KiB)

8.4.4-1.1ubuntu1

Superseded in noble-release on 2023-11-18

Published in mantic-release on 2023-09-07

Deleted in mantic-proposed (Reason: Moved to mantic)

frr (8.4.4-1.1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2033921). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership

 -- Andreas Hasenack <email address hidden>  Fri, 01 Sep 2023 15:15:39 -0300

Available diffs

diff from 8.4.4-1ubuntu1 to 8.4.4-1.1ubuntu1 (4.5 KiB)

8.4.2-1ubuntu1.3

Superseded in lunar-updates on 2023-10-18

Superseded in lunar-security on 2023-10-18

frr (8.4.2-1ubuntu1.3) lunar-security; urgency=medium

  * SECURITY UPDATE: a BGP route attribute, tunnel encapsulation, can
    be corrupted and cause denial of service
    - debian/patches/CVE-2023-38802.patch: use treat-as-withdraw for
      tunnel encapsulation attribute
    - CVE-2023-31490

 -- Mark Esler <email address hidden>  Wed, 30 Aug 2023 10:33:16 -0500

Available diffs

diff from 8.4.2-1ubuntu1.2 to 8.4.2-1ubuntu1.3 (1.8 KiB)

8.1-1ubuntu1.5

Superseded in jammy-updates on 2023-10-18

Superseded in jammy-security on 2023-10-18

frr (8.1-1ubuntu1.5) jammy-security; urgency=medium

  * SECURITY UPDATE: a BGP route attribute, tunnel encapsulation, can
    be corrupted and cause denial of service
    - debian/patches/CVE-2023-38802.patch: use treat-as-withdraw for
      tunnel encapsulation attribute
    - CVE-2023-31490

 -- Mark Esler <email address hidden>  Wed, 30 Aug 2023 10:39:00 -0500

Available diffs

diff from 8.1-1ubuntu1.4 to 8.1-1ubuntu1.5 (1.8 KiB)

8.4.4-1ubuntu1

Superseded in mantic-release on 2023-09-07

Deleted in mantic-proposed on 2023-09-09 (Reason: Moved to mantic)

frr (8.4.4-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2018072). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership
  * Dropped:
    - SECURITY UPDATE: denial of service via bgp_capability_llgr()
      + debian/patches/CVE-2023-31489.patch: check 7 bytes for Long-lived
        Graceful-Restart capability in bgpd/bgp_open.c.
      + CVE-2023-31489
        [Fixed upstream in 8.4.4]
    - SECURITY UPDATE: denial of service via bgp_attr_psid_sub()
      + debian/patches/CVE-2023-31490.patch: ensure stream received has
        enough data in bgpd/bgp_attr.c.
      + CVE-2023-31490
        [Fixed upstream in version 8.4.4]

 -- Andreas Hasenack <email address hidden>  Wed, 26 Jul 2023 17:43:05 -0300

Available diffs

diff from 8.4.2-1ubuntu2 to 8.4.4-1ubuntu1 (45.0 KiB)
diff from 8.4.2-1ubuntu3 to 8.4.4-1ubuntu1 (45.6 KiB)

8.4.2-1ubuntu3

Superseded in mantic-proposed on 2023-07-26

frr (8.4.2-1ubuntu3) mantic; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2023-3748.patch: replacing continue in loops
      to goto done in bebeld/message.c.
    - CVE-2023-3748

 -- Leonidas Da Silva Barbosa <email address hidden>  Thu, 20 Jul 2023 12:39:24 -0300

Available diffs

diff from 8.4.2-1ubuntu2 to 8.4.2-1ubuntu3 (1.1 KiB)

8.4.2-1ubuntu1.2

Superseded in lunar-updates on 2023-08-31

Superseded in lunar-security on 2023-08-31

frr (8.4.2-1ubuntu1.2) lunar-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2023-3748.patch: replacing continue in loops
      to goto done in bebeld/message.c.
    - CVE-2023-3748

 -- Leonidas Da Silva Barbosa <email address hidden>  Thu, 20 Jul 2023 12:55:46 -0300

Available diffs

diff from 8.4.2-1ubuntu1.1 to 8.4.2-1ubuntu1.2 (1.1 KiB)

8.1-1ubuntu1.4

Superseded in jammy-updates on 2023-08-31

Superseded in jammy-security on 2023-08-31

frr (8.1-1ubuntu1.4) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service via bgp_attr_psid_sub()
    - debian/patches/CVE-2023-31490.patch: ensure stream received has
      enough data in bgpd/bgp_attr.c.
    - CVE-2023-31490

 -- Marc Deslauriers <email address hidden>  Fri, 02 Jun 2023 13:56:18 -0400

Available diffs

diff from 8.1-1ubuntu1.3 (in Ubuntu) to 8.1-1ubuntu1.4 (2.1 KiB)
diff from 8.1-1ubuntu1.2 to 8.1-1ubuntu1.4 (2.8 KiB)

8.1-1ubuntu3.2

Obsolete in kinetic-updates on 2023-11-13

Obsolete in kinetic-security on 2023-11-13

frr (8.1-1ubuntu3.2) kinetic-security; urgency=medium

  * SECURITY UPDATE: denial of service via bgp_attr_psid_sub()
    - debian/patches/CVE-2023-31490.patch: ensure stream received has
      enough data in bgpd/bgp_attr.c.
    - CVE-2023-31490

 -- Marc Deslauriers <email address hidden>  Fri, 02 Jun 2023 13:55:27 -0400

Available diffs

diff from 8.1-1ubuntu3.1 (in Ubuntu) to 8.1-1ubuntu3.2 (2.1 KiB)
diff from 8.1-1ubuntu3 (in Ubuntu) to 8.1-1ubuntu3.2 (2.8 KiB)

8.4.2-1ubuntu1.1

Superseded in lunar-updates on 2023-07-24

Superseded in lunar-security on 2023-07-24

frr (8.4.2-1ubuntu1.1) lunar-security; urgency=medium

  * SECURITY UPDATE: denial of service via bgp_capability_llgr()
    - debian/patches/CVE-2023-31489.patch: check 7 bytes for Long-lived
      Graceful-Restart capability in bgpd/bgp_open.c.
    - CVE-2023-31489
  * SECURITY UPDATE: denial of service via bgp_attr_psid_sub()
    - debian/patches/CVE-2023-31490.patch: ensure stream received has
      enough data in bgpd/bgp_attr.c.
    - CVE-2023-31490

 -- Marc Deslauriers <email address hidden>  Fri, 02 Jun 2023 13:14:57 -0400

Available diffs

diff from 8.4.2-1ubuntu1 (in Ubuntu) to 8.4.2-1ubuntu1.1 (2.6 KiB)

8.4.2-1ubuntu2

Superseded in mantic-release on 2023-07-27

Deleted in mantic-proposed on 2023-07-28 (Reason: Moved to mantic)

frr (8.4.2-1ubuntu2) mantic; urgency=medium

  * SECURITY UPDATE: denial of service via bgp_capability_llgr()
    - debian/patches/CVE-2023-31489.patch: check 7 bytes for Long-lived
      Graceful-Restart capability in bgpd/bgp_open.c.
    - CVE-2023-31489
  * SECURITY UPDATE: denial of service via bgp_attr_psid_sub()
    - debian/patches/CVE-2023-31490.patch: ensure stream received has
      enough data in bgpd/bgp_attr.c.
    - CVE-2023-31490

 -- Marc Deslauriers <email address hidden>  Fri, 02 Jun 2023 13:14:57 -0400

Available diffs

diff from 8.4.2-1ubuntu1 to 8.4.2-1ubuntu2 (2.6 KiB)

8.4.2-1ubuntu1

Superseded in mantic-release on 2023-06-03

Published in lunar-release on 2023-01-31

Deleted in lunar-proposed (Reason: Moved to lunar)

frr (8.4.2-1ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership

 -- Andreas Hasenack <email address hidden>  Sun, 29 Jan 2023 15:28:40 -0300

Available diffs

diff from 8.4.1-2ubuntu1 to 8.4.2-1ubuntu1 (17.3 KiB)

8.4.1-2ubuntu1

Superseded in lunar-release on 2023-01-31

Deleted in lunar-proposed on 2023-02-01 (Reason: Moved to lunar)

frr (8.4.1-2ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable (LP: #1993401). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership
  * Dropped (fixed upstream):
    - SECURITY UPDATE: overflow via input packet length
      + debian/patches/CVE-2022-26125.patch: fix router capability TLV
        parsing issues in isisd/isis_tlvs.*.
      + debian/patches/disable_isisd_fuzz_test.patch: disable fuzz tests as
        the security update changed expected results in
        tests/isisd/test_fuzz_isis_tlv.py.
      + CVE-2022-26125
    - SECURITY UPDATE: overflow via use of strdup with binary string
      + debian/patches/CVE-2022-26126.patch: use base64 encoding in
        isisd/isis_nb_notifications.c, lib/base64.c, lib/base64.h,
        lib/subdir.am, lib/yang_wrappers.c, lib/yang_wrappers.h.
      + CVE-2022-26126
    - SECURITY UPDATE: overflow via missing check on the input packet length
      + debian/patches/CVE-2022-26127.patch: add check on packet length in
        babeld/message.c.
      + CVE-2022-2612
    - SECURITY UPDATE: overflow via wrong checks
      + debian/patches/CVE-2022-26128_9.patch: fix checks on length in
        babeld/message.c.
      + CVE-2022-26128
      + CVE-2022-26129
    - SECURITY UPDATE: DoS via out-of-bounds read
      + debian/patches/CVE-2022-37032.patch: make sure hdr length is at a
        minimum of what is expected in bgpd/bgp_packet.c.
      + CVE-2022-37032
    - SECURITY UPDATE: use-after-free due to a race condition
      + debian/patches/CVE-2022-37035.patch: avoid notify race between io and
        main pthreads in bgpd/bgp_io.c, bgpd/bgp_packet.c, bgpd/bgp_packet.h.
      + CVE-2022-37035

 -- Andreas Hasenack <email address hidden>  Sun, 08 Jan 2023 17:57:05 -0300

Available diffs

diff from 8.1-1ubuntu4 to 8.4.1-2ubuntu1 (2.0 MiB)

7.2.1-1ubuntu0.2

Published in focal-updates on 2022-12-13

Deleted in focal-proposed (Reason: moved to -updates)

frr (7.2.1-1ubuntu0.2) focal; urgency=medium

  * d/frr.postinst: don't change log ownership if the syslog user
    doesn't exist. Thanks to Alessandro Ratti
    <email address hidden> for the fix (LP: #1991812).

 -- Andreas Hasenack <email address hidden>  Fri, 28 Oct 2022 14:12:00 -0300

Available diffs

diff from 7.2.1-1ubuntu0.1 to 7.2.1-1ubuntu0.2 (1015 bytes)

8.1-1ubuntu1.3

Superseded in jammy-updates on 2023-06-05

Deleted in jammy-proposed on 2023-06-06 (Reason: moved to -updates)

frr (8.1-1ubuntu1.3) jammy; urgency=medium

  * d/frr.postinst: don't change log ownership if the syslog user
    doesn't exist. Thanks to Alessandro Ratti
    <email address hidden> for the fix (LP: #1991812).

 -- Andreas Hasenack <email address hidden>  Fri, 28 Oct 2022 11:38:34 -0300

Available diffs

8.1-1ubuntu3.1

Superseded in kinetic-updates on 2023-06-05

Deleted in kinetic-proposed on 2023-06-06 (Reason: moved to -updates)

frr (8.1-1ubuntu3.1) kinetic; urgency=medium

  * d/frr.postinst: don't change log ownership if the syslog user
    doesn't exist. Thanks to Alessandro Ratti
    <email address hidden> for the fix (LP: #1991812).

 -- Andreas Hasenack <email address hidden>  Fri, 28 Oct 2022 11:37:23 -0300

Available diffs

diff from 8.1-1ubuntu3 to 8.1-1ubuntu3.1 (1023 bytes)

8.1-1ubuntu4

Superseded in lunar-release on 2023-01-12

Deleted in lunar-proposed on 2023-01-14 (Reason: Moved to lunar)

frr (8.1-1ubuntu4) lunar; urgency=medium

  * d/frr.postinst: don't change log ownership if the syslog user
    doesn't exist. Thanks to Alessandro Ratti
    <email address hidden> for the fix (LP: #1991812).

 -- Andreas Hasenack <email address hidden>  Fri, 28 Oct 2022 11:35:27 -0300

Available diffs

diff from 8.1-1ubuntu3 to 8.1-1ubuntu4 (1.0 KiB)

8.1-1ubuntu1.2

Superseded in jammy-updates on 2022-12-13

Superseded in jammy-security on 2023-06-05

frr (8.1-1ubuntu1.2) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS via out-of-bounds read
    - debian/patches/CVE-2022-37032.patch: make sure hdr length is at a
      minimum of what is expected in bgpd/bgp_packet.c.
    - CVE-2022-37032
  * SECURITY UPDATE: use-after-free due to a race condition
    - debian/patches/CVE-2022-37035.patch: avoid notify race between io and
      main pthreads in bgpd/bgp_io.c, bgpd/bgp_packet.c, bgpd/bgp_packet.h.
    - CVE-2022-37035

 -- Marc Deslauriers <email address hidden>  Wed, 05 Oct 2022 12:35:26 -0400

Available diffs

diff from 8.1-1ubuntu1.1 (in Ubuntu) to 8.1-1ubuntu1.2 (2.7 KiB)
diff from 8.1-1ubuntu1 (in Ubuntu) to 8.1-1ubuntu1.2 (3.5 KiB)

8.1-1ubuntu3

Superseded in lunar-release on 2022-11-20

Obsolete in kinetic-release on 2023-11-13

Deleted in kinetic-proposed (Reason: Moved to kinetic)

frr (8.1-1ubuntu3) kinetic; urgency=medium

  * SECURITY UPDATE: DoS via out-of-bounds read
    - debian/patches/CVE-2022-37032.patch: make sure hdr length is at a
      minimum of what is expected in bgpd/bgp_packet.c.
    - CVE-2022-37032
  * SECURITY UPDATE: use-after-free due to a race condition
    - debian/patches/CVE-2022-37035.patch: avoid notify race between io and
      main pthreads in bgpd/bgp_io.c, bgpd/bgp_packet.c, bgpd/bgp_packet.h.
    - CVE-2022-37035

 -- Marc Deslauriers <email address hidden>  Wed, 05 Oct 2022 12:31:38 -0400

Available diffs

diff from 8.1-1ubuntu2 to 8.1-1ubuntu3 (2.7 KiB)

7.2.1-1ubuntu0.1

Superseded in focal-updates on 2022-12-13

Deleted in focal-proposed on 2022-12-14 (Reason: moved to -updates)

frr (7.2.1-1ubuntu0.1) focal; urgency=medium

  * Fix logging with Ubuntu's unprivileged rsyslog (LP: #1958162):
    - d/frr.postinst: change log files ownership
    - d/frr.logrotate: change rotated log file ownership

 -- Andreas Hasenack <email address hidden>  Tue, 19 Jul 2022 17:40:11 -0300

Available diffs

diff from 7.2.1-1 (in Debian) to 7.2.1-1ubuntu0.1 (1.2 KiB)

8.1-1ubuntu1.1

Superseded in jammy-updates on 2022-10-18

Deleted in jammy-proposed on 2022-10-19 (Reason: moved to -updates)

frr (8.1-1ubuntu1.1) jammy; urgency=medium

  * Fix logging with Ubuntu's unprivileged rsyslog (LP: #1958162):
    - d/frr.postinst: change log files ownership
    - d/frr.logrotate: change rotated log file ownership

 -- Andreas Hasenack <email address hidden>  Tue, 19 Jul 2022 17:36:23 -0300

Available diffs

diff from 8.1-1ubuntu1 to 8.1-1ubuntu1.1 (1.1 KiB)

8.1-1ubuntu2

Superseded in kinetic-release on 2022-10-08

Deleted in kinetic-proposed on 2022-10-09 (Reason: Moved to kinetic)

frr (8.1-1ubuntu2) kinetic; urgency=medium

  * Fix logging with Ubuntu's unprivileged rsyslog (LP: #1958162):
    - d/frr.postinst: change log files ownership
    - d/frr.logrotate: change rotated log file ownership

 -- Andreas Hasenack <email address hidden>  Thu, 09 Jun 2022 12:35:58 -0300

Available diffs

diff from 8.1-1ubuntu1 to 8.1-1ubuntu2 (1.1 KiB)

8.1-1ubuntu1

Superseded in kinetic-release on 2022-06-24

Published in jammy-release on 2022-03-11

Deleted in jammy-proposed (Reason: Moved to jammy)

frr (8.1-1ubuntu1) jammy; urgency=medium

  * SECURITY UPDATE: overflow via input packet length
    - debian/patches/CVE-2022-26125.patch: fix router capability TLV
      parsing issues in isisd/isis_tlvs.*.
    - debian/patches/disable_isisd_fuzz_test.patch: disable fuzz tests as
      the security update changed expected results in
      tests/isisd/test_fuzz_isis_tlv.py.
    - CVE-2022-26125
  * SECURITY UPDATE: overflow via use of strdup with binary string
    - debian/patches/CVE-2022-26126.patch: use base64 encoding in
      isisd/isis_nb_notifications.c, lib/base64.c, lib/base64.h,
      lib/subdir.am, lib/yang_wrappers.c, lib/yang_wrappers.h.
    - CVE-2022-26126
  * SECURITY UPDATE: overflow via missing check on the input packet length
    - debian/patches/CVE-2022-26127.patch: add check on packet length in
      babeld/message.c.
    - CVE-2022-26127
  * SECURITY UPDATE: overflow via wrong checks
    - debian/patches/CVE-2022-26128_9.patch: fix checks on length in
      babeld/message.c.
    - CVE-2022-26128
    - CVE-2022-26129

 -- Marc Deslauriers <email address hidden>  Fri, 11 Mar 2022 07:33:41 -0500

Available diffs

diff from 8.1-1 (in Debian) to 8.1-1ubuntu1 (6.5 KiB)

8.1-1

Superseded in jammy-release on 2022-03-11

Superseded in jammy-release on 2022-02-22

Deleted in jammy-proposed on 2022-03-13 (Reason: Moved to jammy)

frr (8.1-1) unstable; urgency=medium

  * New upstream release FRR 8.1
  * Upload to unstable.

 -- Ondřej Surý <email address hidden>  Sat, 13 Nov 2021 13:32:48 +0100

Available diffs

diff from 7.5.1-1.1 to 8.1-1 (3.9 MiB)

7.5.1-1.1

Superseded in jammy-release on 2021-12-14

Obsolete in impish-release on 2022-07-23

Deleted in impish-proposed (Reason: Moved to impish)

frr (7.5.1-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Backport upstream fix for compatibility with the bullseye
    libyang1. (Closes: #990585)

 -- Adrian Bunk <email address hidden>  Sun, 11 Jul 2021 19:15:04 +0300

Available diffs

diff from 7.5.1-1 to 7.5.1-1.1 (1.1 KiB)

7.5.1-1

Superseded in impish-release on 2021-07-13

Deleted in impish-proposed on 2021-07-15 (Reason: Moved to impish)

frr (7.5.1-1) unstable; urgency=medium

  * Update the d/gbp.conf for 7.5.1 release
  * Use wrap-and-sort -a to unify debian/ wrapping and sorting
  * Work around the sphinx-build error that doesn't copy images to texinfo
  * Change the upstream-tag in d/gbp.conf to track the upstream tarballs

 -- Ondřej Surý <email address hidden>  Mon, 08 Mar 2021 09:40:19 +0100

Available diffs

diff from 7.5-1build1 (in Ubuntu) to 7.5.1-1 (77.1 KiB)

7.5-1build1

Superseded in impish-release on 2021-05-04

Obsolete in hirsute-release on 2022-07-23

Deleted in hirsute-proposed on 2022-07-24 (Reason: moved to Release)

frr (7.5-1build1) hirsute; urgency=medium

  * No change rebuild with fixed ownership.

 -- Dimitri John Ledkov <email address hidden>  Tue, 16 Feb 2021 15:13:52 +0000

Available diffs

diff from 7.4-1.1 (in Debian) to 7.5-1build1 (1.9 MiB)
diff from 7.5-1 (in Debian) to 7.5-1build1 (524 bytes)

7.5-1

Superseded in hirsute-proposed on 2021-02-16

frr (7.5-1) unstable; urgency=medium

  * New upstream version 7.5

 -- Ondřej Surý <email address hidden>  Sun, 14 Feb 2021 21:38:50 +0100

Available diffs

diff from 7.4-2 to 7.5-1 (1.9 MiB)

7.4-2

Superseded in hirsute-proposed on 2021-02-15

frr (7.4-2) unstable; urgency=medium

  * Bump libyang dependency to >= 1.0.184-1~
  * Make the autopkgtest more resilient (Closes: #980111)
  * Adjust the ax_python.m4 to hardcode python3.9

 -- Ondřej Surý <email address hidden>  Sun, 07 Feb 2021 13:15:07 +0100

Available diffs

diff from 7.4-1.1 to 7.4-2 (1.7 KiB)

7.4-1.1

Superseded in hirsute-release on 2021-02-19

Deleted in hirsute-proposed on 2021-02-21 (Reason: moved to Release)

frr (7.4-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Backport upstream fix for FTBFS with Python 3.9. (Closes: #972767)

 -- Adrian Bunk <email address hidden>  Thu, 21 Jan 2021 16:06:12 +0200

Available diffs

diff from 7.4-1ubuntu1 (in Ubuntu) to 7.4-1.1 (1.2 KiB)

7.4-1ubuntu1

Superseded in hirsute-release on 2021-01-30

Deleted in hirsute-proposed on 2021-01-31 (Reason: moved to Release)

frr (7.4-1ubuntu1) hirsute; urgency=medium

  * d/p/0001-build-find-all-future-minor-versions-of-python3.patch: Fix FTBFS
    when building against Python 3.9.

 -- Sergio Durigan Junior <email address hidden>  Fri, 15 Jan 2021 15:56:54 -0500

Available diffs

diff from 7.4-1 (in Debian) to 7.4-1ubuntu1 (1.3 KiB)
diff from 7.4-1build1 to 7.4-1ubuntu1 (1.3 KiB)

7.4-1build1

Superseded in hirsute-proposed on 2021-01-15

frr (7.4-1build1) hirsute; urgency=medium

  * No-change rebuild to build with python3.9 as default.

 -- Matthias Klose <email address hidden>  Thu, 19 Nov 2020 18:31:41 +0100

Available diffs

diff from 7.4-1 (in Debian) to 7.4-1build1 (313 bytes)

7.4-1

Superseded in hirsute-release on 2021-01-28

Obsolete in groovy-release on 2021-12-22

Deleted in groovy-proposed on 2022-07-23 (Reason: moved to Release)

frr (7.4-1) unstable; urgency=medium

  [ Ondřej Surý ]
  * Use dh_installinit capabilities to install frr.tmpfile
  * Remove unused debian/watchfrr.rc file
  * Add missing lsof dependency
  * Remove mention of pkg.frr.snmp build profile from debian/README.Debian
  * Make lsb-base a hard dependency
  * Update gbp.conf for 7.4 release
  * Update and simplify d/watch
  * Change the debian source format from 3.0 (git) to 3.0 (quilt)
  * Convert the package to dh compat level 10
  * Add myself to Uploaders
  * Bump standards version to 4.5.0.2 (latest) - no change
  * Use wrap-and-sort -a to unify debian/ wrapping and sorting
  * Work around the sphinx-build error that doesn't copy images to texinfo
    (Properly closes: #955067)
  * Depend on debhelper >= 9.20160709 and drop dh-systemd dependency
    (Closes: #958626)

 -- Ondřej Surý <email address hidden>  Mon, 10 Aug 2020 11:50:45 +0200

Available diffs

diff from 7.2.1-1 to 7.4-1 (2.2 MiB)
diff from 7.3.1-1build1 (in Ubuntu) to 7.4-1 (1.0 MiB)

7.3.1-1build1

Superseded in groovy-proposed on 2020-08-10

frr (7.3.1-1build1) groovy; urgency=medium

  * No change rebuild against new json-c ABI.

 -- Dimitri John Ledkov <email address hidden>  Tue, 28 Jul 2020 17:43:41 +0100

Available diffs

diff from 7.3.1-1 (in Debian) to 7.3.1-1build1 (523 bytes)

7.3.1-1

Superseded in groovy-proposed on 2020-07-28

frr (7.3.1-1) unstable; urgency=medium

  [ David Lamparter ]
  * allow cross-compile with sbuild --host

  [ Ondřej Surý ]
  * Add myself to Uploaders
  * Add d/gbp.conf
  * Update changelog for 7.3.1-1~1.gbp2292a4 release
  * Change the source format from git to quilt to use git-buildpackage
  * Don't install frr-doc texinfo images, they are gone (Closes: #955067)
  * Bump the dh_compat to 10

 -- Ondřej Surý <email address hidden>  Mon, 01 Jun 2020 08:41:03 +0200

7.2.1-1

Deleted in groovy-release (Reason: release pocket is ftbfs with gcc-10; proposed pocket is f...)

Published in focal-release on 2020-02-20

Deleted in focal-proposed (Reason: moved to Release)

frr (7.2.1-1) unstable; urgency=medium

  * new upstream release
  * daemon man pages renamed to frr-* (closes: #944392)
  * fix/improve multi-arch markers on doc
  * fix git URLs to point to debian branch

 -- David Lamparter <email address hidden>  Mon, 20 Jan 2020 17:06:21 +0100

Available diffs

diff from 7.2-1ubuntu2 (in Ubuntu) to 7.2.1-1 (117.6 KiB)

7.2-1ubuntu2

Superseded in focal-release on 2020-02-20

Deleted in focal-proposed on 2020-02-22 (Reason: moved to Release)

frr (7.2-1ubuntu2) focal; urgency=medium

  * No-change rebuild to build with python3.8.

 -- Matthias Klose <email address hidden>  Sat, 25 Jan 2020 04:31:03 +0000

Available diffs

diff from 7.2-1ubuntu1 to 7.2-1ubuntu2 (314 bytes)

7.2-1ubuntu1

Superseded in focal-release on 2020-01-25

Deleted in focal-proposed on 2020-01-26 (Reason: moved to Release)

frr (7.2-1ubuntu1) focal; urgency=medium

  * d/p/fix-endian-bug-in-test_typelist.patch: fix test
    failure on big endian.  Thanks to Mark Stapp <email address hidden>.
    (LP: #1860733)

 -- Andreas Hasenack <email address hidden>  Fri, 24 Jan 2020 10:53:23 -0300

Available diffs

diff from 6.0.2-2build2 to 7.2-1ubuntu1 (1.8 MiB)
diff from 7.2-1build1 to 7.2-1ubuntu1 (1.3 KiB)

7.2-1build1

Superseded in focal-proposed on 2020-01-24

frr (7.2-1build1) focal; urgency=medium

  * Rebuild for libsnmp35.

 -- Rafael David Tinoco <email address hidden>  Tue, 14 Jan 2020 16:44:41 +0000

Available diffs

diff from 7.2-1 (in Debian) to 7.2-1build1 (293 bytes)

7.2-1

Superseded in focal-proposed on 2020-01-15

frr (7.2-1) unstable; urgency=medium

  * New upstream release

 -- Jafar Al-Gharaibeh <email address hidden>  Sun, 03 Nov 2019 18:45:23 +0100

6.0.2-2build2

Superseded in focal-release on 2020-01-24

Obsolete in eoan-release on 2020-12-29

Deleted in eoan-proposed on 2020-12-29 (Reason: moved to release)

frr (6.0.2-2build2) eoan; urgency=medium

  * No-change upload with strops.h and sys/strops.h removed in glibc.

 -- Matthias Klose <email address hidden>  Thu, 05 Sep 2019 10:49:52 +0000

Available diffs

diff from 6.0.2-2build1 to 6.0.2-2build2 (320 bytes)

6.0.2-2build1

Superseded in eoan-release on 2019-09-06

Deleted in eoan-proposed on 2019-09-07 (Reason: moved to release)

frr (6.0.2-2build1) eoan; urgency=medium

  * Rebuild against new libjson-c4.

 -- Gianfranco Costamagna <email address hidden>  Sat, 29 Jun 2019 13:50:00 +0200

Available diffs

diff from 6.0.2-2 (in Debian) to 6.0.2-2build1 (324 bytes)

6.0.2-2

Superseded in eoan-release on 2019-07-05

Obsolete in disco-release on 2020-07-14

Deleted in disco-proposed on 2020-07-14 (Reason: moved to release)

frr (6.0.2-2) unstable; urgency=medium

  * remove bogus libjson0 build-dep (closes: #921349)
  * fix broken systemd dependency spec
  * add proper Conflicts: for quagga and pimd (closes: #921376)

 -- David Lamparter <email address hidden>  Mon, 04 Feb 2019 22:16:07 +0100

Available diffs

diff from 6.0.2-1 to 6.0.2-2 (1.6 KiB)

6.0.2-1

Superseded in disco-release on 2019-02-05

Deleted in disco-proposed on 2019-02-06 (Reason: moved to release)

frr (6.0.2-1) unstable; urgency=medium

  * Packaging has been more or less completely reworked, based off the old
    Quagga packaging that hung around in git.  Refer to "changelog-auto.in"
    in the source root directory for the old changelog.
  * Initial release of FRR for Debian. (closes: #863249)

 -- David Lamparter <email address hidden>  Sun, 27 Jan 2019 17:27:02 +0100

Ubuntufrr package

Change log for frr package in Ubuntu

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Ubuntu
frr package