-
dotnet6 (6.0.120-0ubuntu1~22.10.1) kinetic-security; urgency=medium
* New upstream release.
* SECURITY UPDATE: security feature bypass
- CVE-2023-33170: Race Condition in ASP.NET Core SignInManager<TUser>
PasswordSignInAsync Method
* debian/tests/control: enabled test dotnet-runtime-json-contains-ubuntu-rids
* debian/tests/.tests.rc.d/init.sh: fixed parsing error of runtime revision number
-- Nishit Majithia <email address hidden> Thu, 06 Jul 2023 11:41:52 +0530
-
dotnet6 (6.0.119-0ubuntu1~22.10.1) kinetic-security; urgency=medium
[ Dominik Viererbe ]
* New upstream release.
- Fixes regression that was introduced with the bugfix for CVE-2023-29331:
Loading null-password-encrypted PFX certificates through .NET can fail
unexpectedly for certificates that previously loaded successfully.
-- Nishit Majithia <email address hidden> Thu, 22 Jun 2023 15:19:23 +0530
-
dotnet6 (6.0.118-0ubuntu1~22.10.1) kinetic-security; urgency=medium
* New upstream release.
* SECURITY UPDATE: elevation of privilege
- CVE-2023-24936: Bypass restrictions when deserializing a DataSet or
DataTable from XML.
* SECURITY UPDATE: denial of service
- CVE-2023-29331: When a .NET application is internet-facing and accepts
an X509 client certificate for mutual TLS, a malicious client certificate
can cause unbounded CPU usage.
* SECURITY UPDATE: remote code exection
- CVE-2023-29337: A vulnerability exists in NuGet where a potential race
condition can lead to a symlink attack.
* SECURITY UPDATE: remote code execution
- CVE-2023-33128: An issue in source generators can lead to a crash due to
unmanaged heap corruption.
* debian/patches/add-kinetic-rids.patch: removed due to inclusion upstream.
[ Dominik Viererbe ]
* d/t: extended autopkgtest:
* essential-binaries-and-config-files-should-be-present
* cli-metadata-should-be-correct
* global-json-should-be-detected
* console-template-should-build-and-run
* dotnet-help-should-show-output
* dotnet-project-management-cli-should-work
* example-fsharp-script-output-should-equal-expected-values
* building-hello-world-for-all-supported-rids-should-work
* dotnet-xunit-tests-should-work
* nuget-cli-should-be-able-to-consume-packages-from-nuget-gallery
* crossbuild-for-windows-x64-should-run
* dotnet6-and-dotnet7-should-work-together
-- Ian Constantin <email address hidden> Fri, 02 Jun 2023 18:32:40 +0300
-
dotnet6 (6.0.116-0ubuntu1~22.10.1) kinetic-security; urgency=medium
* New upstream release.
* SECURITY UPDATE: elevation of privilege
- CVE-2023-28260: AzureDevOps Elevation of Privilege - Dotnet CWD dll
hijack vuln.
-- Ian Constantin <email address hidden> Wed, 05 Apr 2023 16:09:08 +0300
-
dotnet6 (6.0.115-0ubuntu2~22.10.1) kinetic; urgency=medium
* Backport dotnet 6.0.115 to kinetic (LP: #2011807).
- debian/control: revert to libicu71
-- Dominik Viererbe <email address hidden> Wed, 22 Mar 2023 13:11:32 +0200
-
dotnet6 (6.0.114-0ubuntu1~22.10.1) kinetic; urgency=medium
* Backport dotnet 6.0.114 to kinetic (LP: #2009852).
* debian/control: revert to libicu71.
-- Dominik Viererbe <email address hidden> Fri, 10 Mar 2023 15:16:10 +0200
-
dotnet6 (6.0.113-0ubuntu1~22.10.1) kinetic-security; urgency=medium
* New upstream release.
* SECURITY UPDATE: denial of service
- CVE-2023-21538: Parsing an empty HTTP response as a JSON.NET JObject
causes a stack overflow and crashes a process.
-- Ian Constantin <email address hidden> Mon, 09 Jan 2023 22:08:22 +0200
-
dotnet6 (6.0.112-0ubuntu1~22.10.2) kinetic; urgency=medium
* d/rules: Fix path for finding older sdk when building.
dotnet6 (6.0.112-0ubuntu1~22.10.1) kinetic; urgency=medium
* New upstream release (LP: #1999549).
* d/p/series: Removing patch
73065-runtime-fix-definition-cpuid-clang-15.patch.
* d/dotnet-host.install.in: Fix destination of install_location*
files (LP: #1999266).
* d/dotnet.sh.in: Eliminate the condition to force updating of
DOTNET_ROOT variable (LP: #1997746).
-- Miriam España Acebal <email address hidden> Fri, 16 Dec 2022 09:45:43 +0100
-
dotnet6 (6.0.112-0ubuntu1~22.10.1) kinetic; urgency=medium
* New upstream release (LP: #1999549).
* d/p/series: Removing patch
73065-runtime-fix-definition-cpuid-clang-15.patch.
* d/dotnet-host.install.in: Fix destination of install_location*
files (LP: #1999266).
* d/dotnet.sh.in: Eliminate the condition to force updating of
DOTNET_ROOT variable (LP: #1997746).
-- Miriam España Acebal <email address hidden> Tue, 13 Dec 2022 11:03:19 +0100
-
dotnet6 (6.0.111-0ubuntu1~22.10.1) kinetic; urgency=medium
* New upstream release.
* d/build-dotnet-tarball-sh: No removing libunwind needed by arm64.
* d/control: building for arm64 too.
* d/copyright: Non excluding libunwind needed by arm64..
* d/dotnet-host.install.in: Removing manpages and bash-completion.
* d/dotnet-host.links.in: New file for dotnet binary.
* d/dotnet-host.preinst: New file for removing alternatives.
* d/dotnet-host.manpages : New file.
* d/dotnet-host.lintian-overrides: New file for man page warnings
that are being fixed in upstream.
* d/p/remove-libunwind-build.patch : Modified to apply depending
on architecture.
* d/rules:
+ DOTNETLIBDIR is now only DOTNET_TOP
+ Adding --with bash-completion
+ Eliminating dependants creation for alternatives.
+ Eliminating manual installation of man pages.
(LP: #1996499)
-- Miriam España Acebal <email address hidden> Mon, 31 Oct 2022 14:32:47 +0200
-
dotnet6 (6.0.110-0ubuntu1) kinetic; urgency=medium
* New upstream release.
* SECURITY UPDATE: cache poisoning
- CVE-2022-41032: Nuget cache poisoning via world-writable cache directory.
[ Miriam España Acebal ]
* d/rules: _minor_sdk_version calculation updated to parse last two digits.
* d/p/10199-arcade-add-clang-15-autodetection.patch
and d/p/73065-runtime-fix-definition-cpuid-clang-15.patch: New
patches for avoiding FTBFS when using clang-15 on amd64 architectures.
-- Ian Constantin <email address hidden> Tue, 11 Oct 2022 11:11:12 -0400
-
dotnet6 (6.0.109-0ubuntu1) kinetic; urgency=medium
* New upstream release.
* SECURITY UPDATE: denial of service
- CVE-2022-38013: ASP.NET Core MVC vulnerable to stack overflow via
ModelStateDictionary recursion.
* d/control: removed the libunwind-13 dependency for dotnet-runtime-6.0
(LP: 1984450)
* d/README.source: updated with info regarding private repo use.
-- Ian Constantin <email address hidden> Mon, 12 Sep 2022 17:59:11 -0400
-
dotnet6 (6.0.108-0ubuntu1) kinetic; urgency=medium
* New upstream release.
* SECURITY UPDATE
- CVE-2022-34716: External Entity Injection during XML signature
verification
-- Miriam España Acebal <email address hidden> Thu, 04 Aug 2022 11:00:57 +0200
-
dotnet6 (6.0.107-0ubuntu2) kinetic; urgency=medium
* d/copyright: Removing references to licenses for excluded
libunwind vendorized code.
* d/dotnet-host.bash-completion.in: Fixed path.
* d/s/lintian-overrides: Fixing new format for lintian output.
Added some new overrides for code shipped in the new tarball.
[ Jesús Soto ]
* d/copyright: Added vendorized libunwind code to Files-Excludes.
-- Miriam España Acebal <email address hidden> Tue, 26 Jul 2022 11:17:40 +0200
-
dotnet6 (6.0.107-0ubuntu1) kinetic; urgency=medium
* New upstream version.
* d/copyright: Added Files-Excluded stanza.
* d/rules: Got the minor version for the SDK and apply it to the
Priority on alternatives too.
* d/build-dotnet-tarball.sh: Changed it to work with embargoed repo
(new logic).
* d/watch: Added commented part to work without script with a public
monorepo. Added template/example/invalid parameter for the script.
* d/README.source: Reflects now the new origtarball building,
remove text about aggregated repositories building and not use
of the d/p/series file.
[ Jesús Soto ]
* d/p/remove-libunwind-build.patch: Adapt CMakeLists.txt for use
system libunwind instead of vendorized code.
* d/p/series: Added above patch.
* d/control: Added libunwind-dev to build dependencies and
libunwind-13 as dotnet-runtime-6.0 dependency.
* d/copyright: Added list of precompiled binaries files not used
in building.
-- Miriam España Acebal <email address hidden> Tue, 22 Jul 2022 13:41:58 +0200
-
dotnet6 (6.0.106-0ubuntu2) kinetic; urgency=medium
* dotnet-runtime-6.0: bump dependency on libicu70 ->
libicu71 for the ICU transition
* dotnet-runtime-6.0: drop dependency on libunwind-13,
we currently use the vendored copy of libunwind
-- Graham Inggs <email address hidden> Thu, 30 Jun 2022 09:36:29 +0000
-
dotnet6 (6.0.106-0ubuntu1) kinetic; urgency=medium
* Initial Release (LP: #1979414)
[ Steve Langasek ]
* Adjustments to debian/copyright declarations based on Ubuntu NEW review.
-- Miriam España Acebal <email address hidden> Wed, 22 Jun 2022 13:22:15 +0200
