frr 8.4.1-2ubuntu1 source package in Ubuntu

Changelog

frr (8.4.1-2ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable (LP: #1993401). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership
  * Dropped (fixed upstream):
    - SECURITY UPDATE: overflow via input packet length
      + debian/patches/CVE-2022-26125.patch: fix router capability TLV
        parsing issues in isisd/isis_tlvs.*.
      + debian/patches/disable_isisd_fuzz_test.patch: disable fuzz tests as
        the security update changed expected results in
        tests/isisd/test_fuzz_isis_tlv.py.
      + CVE-2022-26125
    - SECURITY UPDATE: overflow via use of strdup with binary string
      + debian/patches/CVE-2022-26126.patch: use base64 encoding in
        isisd/isis_nb_notifications.c, lib/base64.c, lib/base64.h,
        lib/subdir.am, lib/yang_wrappers.c, lib/yang_wrappers.h.
      + CVE-2022-26126
    - SECURITY UPDATE: overflow via missing check on the input packet length
      + debian/patches/CVE-2022-26127.patch: add check on packet length in
        babeld/message.c.
      + CVE-2022-2612
    - SECURITY UPDATE: overflow via wrong checks
      + debian/patches/CVE-2022-26128_9.patch: fix checks on length in
        babeld/message.c.
      + CVE-2022-26128
      + CVE-2022-26129
    - SECURITY UPDATE: DoS via out-of-bounds read
      + debian/patches/CVE-2022-37032.patch: make sure hdr length is at a
        minimum of what is expected in bgpd/bgp_packet.c.
      + CVE-2022-37032
    - SECURITY UPDATE: use-after-free due to a race condition
      + debian/patches/CVE-2022-37035.patch: avoid notify race between io and
        main pthreads in bgpd/bgp_io.c, bgpd/bgp_packet.c, bgpd/bgp_packet.h.
      + CVE-2022-37035

 -- Andreas Hasenack <email address hidden>  Sun, 08 Jan 2023 17:57:05 -0300