Current File : //snap/core22/2437/usr/share/doc/ChangeLog
10/04/2026, commit https://github.com/canonical/core-base/tree/afed2422f81dbe3b315be43b4b5e122a43e98d85
[ Changes in the core22 snap ]
Andrew Phelps (1):
tools: do not use python3.12 feature since this builds with python3.10 (#428)
Philip Meulengracht (1):
tools/generate-changelog: port changes from core24 to handle missing packages (#413)
[ Changes in primed packages ]
coreutils (built from coreutils) updated from 8.32-4.1ubuntu1.2 to 8.32-4.1ubuntu1.3:
coreutils (8.32-4.1ubuntu1.3) jammy; urgency=medium
* Fix slow performance of 'du' on large directories (>= 10K files)
on Lustre filesystems by skipping inode sorting. The default
behaviour of sorting dirents by inode numbers negatively impacts
performance on Lustre because it interferes with Lustre's ability
to prefetch file metadata via statahead. (LP: #2137373)
- d/p/lp2137373-skip-dirent-inode-sorting-for-lustre.patch
-- Munir Siddiqui <munir.siddiqui@canonical.com> Fri, 23 Jan 2026 15:51:17 +0500
libssh-4:amd64 (built from libssh) updated from 0.9.6-2ubuntu0.22.04.6 to 0.9.6-2ubuntu0.22.04.7:
libssh (0.9.6-2ubuntu0.22.04.7) jammy-security; urgency=medium
* SECURITY UPDATE: out-of-bound read
- debian/patches/CVE-2026-3731.patch: correct bounds checks when querying
for an SFTP extension name or data in src/sftp.c.
- CVE-2026-3731
-- Ian Constantin <ian.constantin@canonical.com> Wed, 11 Mar 2026 12:19:27 +0200
openssh-client, openssh-server, openssh-sftp-server (built from openssh) updated from 1:8.9p1-3ubuntu0.13 to 1:8.9p1-3ubuntu0.14:
openssh (1:8.9p1-3ubuntu0.14) jammy-security; urgency=medium
* SECURITY UPDATE: GSSAPI Key Exchange issue
- debian/patches/gssapi.patch: replace incorrect use of
sshpkt_disconnect() with ssh_packet_disconnect() and properly
initialize some vars.
- CVE-2026-3497
* SECURITY UPDATE: Untrusted control characters in usernames
- debian/patches/CVE-2025-61984.patch: refuse usernames that include
control characters in ssh.c.
- CVE-2025-61984
* SECURITY UPDATE: Code execution in ProxyCommand via NULL character
- debian/patches/CVE-2025-61985.patch: don't allow 0 characters in
url-encoded strings in misc.c.
- CVE-2025-61985
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 04 Mar 2026 12:55:04 -0500
libssl3:amd64, openssl (built from openssl) updated from 3.0.2-0ubuntu1.21 to 3.0.2-0ubuntu1.23:
openssl (3.0.2-0ubuntu1.23) jammy-security; urgency=medium
* SECURITY UPDATE: NULL pointer dereference when processing an OCSP
response
- debian/patches/CVE-2026-28387.patch: dane_match_cert() should
X509_free() on ->mcert instead of OPENSSL_free() in
crypto/x509/x509_vfy.c.
- CVE-2026-28387
* SECURITY UPDATE: NULL Pointer Dereference When Processing a Delta CRL
- debian/patches/CVE-2026-28388-1.patch: fix NULL Dereference When
Delta CRL Lacks CRL Number Extension in crypto/x509/x509_vfy.c.
- debian/patches/CVE-2026-28388-2.patch: Added test in test/*.
- CVE-2026-28388
* SECURITY UPDATE: Possible NULL dereference when processing CMS
KeyAgreeRecipientInfo
- debian/patches/CVE-2026-28389.patch: Fix NULL deref in
[ec]dh_cms_set_shared_info in crypto/cms/cms_dh.c,
crypto/cms/cms_ec.c.
- CVE-2026-28389
* SECURITY UPDATE: Possible NULL Dereference When Processing CMS
KeyTransportRecipientInfo
- debian/patches/CVE-2026-28390.patch: Fix NULL deref in
rsa_cms_decrypt in crypto/cms/cms_rsa.c.
- CVE-2026-28390
* SECURITY UPDATE: Heap buffer overflow in hexadecimal conversion
- debian/patches/CVE-2026-31789.patch: avoid possible buffer overflow
in buf2hex conversion in crypto/o_str.c.
- CVE-2026-31789
* SECURITY UPDATE: Incorrect failure handling in RSA KEM RSASVE
encapsulation
- debian/patches/CVE-2026-31790-1.patch: validate RSA_public_encrypt()
result in RSASVE in providers/implementations/kem/rsa_kem.c.
- debian/patches/CVE-2026-31790-2.patch: test RSA_public_encrypt()
result in RSASVE in test/evp_extra_test.c.
- CVE-2026-31790
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 07 Apr 2026 08:05:56 -0400
python3-jwt (built from pyjwt) updated from 2.3.0-1ubuntu0.2 to 2.3.0-1ubuntu0.3:
pyjwt (2.3.0-1ubuntu0.3) jammy-security; urgency=medium
* SECURITY UPDATE: Incorrect authorization of invalid JWS token.
- debian/patches/CVE-2026-32597.patch: Add _supported_crit and checks
for valid crit header in jwt/api_jws.py. Add tests in
tests/test_api_jws.py and tests/test_api_jwt.py.
- CVE-2026-32597
-- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> Thu, 26 Mar 2026 14:58:14 -0230
python3-cryptography (built from python-cryptography) updated from 3.4.8-1ubuntu2.2 to 3.4.8-1ubuntu2.4:
python-cryptography (3.4.8-1ubuntu2.4) jammy-security; urgency=medium
* SECURITY REGRESSION: ecc support regression (LP: #2144373)
- debian/patches/CVE-2026-26007.patch: updated to remove problematic
deprecation warning code which is causing a regression with ansible.
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Sat, 14 Mar 2026 08:22:06 -0400
python-cryptography (3.4.8-1ubuntu2.3) jammy-security; urgency=medium
* SECURITY UPDATE: Subgroup Attack Due to Missing Subgroup Validation for
SECT Curves
- debian/patches/CVE-2026-26007-pre1.patch: check if public keys are at
infinity earlier in src/cryptography/hazmat/backends/openssl/ec.py,
tests/hazmat/primitives/test_ec.py.
- debian/patches/CVE-2026-26007.patch: EC check key on cofactor > 1 in
src/cryptography/hazmat/primitives/asymmetric/ec.py,
src/cryptography/utils.py, tests/hazmat/primitives/test_ec.py,
src/_cffi_src/openssl/ec.py,
src/cryptography/hazmat/backends/openssl/ec.py.
- CVE-2026-26007
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Fri, 20 Feb 2026 10:14:37 -0500
libpython3.10-minimal:amd64, libpython3.10-stdlib:amd64, python3.10, python3.10-minimal (built from python3.10) updated from 3.10.12-1~22.04.14 to 3.10.12-1~22.04.15:
python3.10 (3.10.12-1~22.04.15) jammy-security; urgency=medium
* SECURITY REGRESSION: Revert patch for CVE-2025-15366
- debian/patches/CVE-2025-15366.patch: Reverted. Patch breaks RFC
9051 IMAP conformance and introduces behavior regressions avoided
by upstream.
- CVE-2025-15366
* SECURITY REGRESSION: Revert patch for CVE-2025-15367
- debian/patches/CVE-2025-15367.patch: Reverted to prevent behavior
regressions, aligning with upstream backporting decisions.
- CVE-2025-15367
* SECURITY REGRESSION: Allow HTAB in wsgiref header values
- debian/patches/CVE-2026-0865-2.patch: Permit HTAB in header values
(excluding names) in Lib/wsgiref/headers.py, add test coverage.
- CVE-2026-0865
-- Vyom Yadav <vyom.yadav@canonical.com> Tue, 03 Mar 2026 17:26:32 +0530
sudo (built from sudo) updated from 1.9.9-1ubuntu2.5 to 1.9.9-1ubuntu2.6:
sudo (1.9.9-1ubuntu2.6) jammy-security; urgency=medium
* SECURITY UPDATE: exec_mailer gid issue (LP: #2143042)
- debian/patches/lp2143042.patch: set group as well as uid when running
the mailer and make a setuid(), setgid() or setgroups() failure fatal
in include/sudo_eventlog.h, lib/eventlog/eventlog.c,
lib/eventlog/eventlog_conf.c, plugins/sudoers/logging.c,
plugins/sudoers/policy.c.
- No CVE number
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 02 Mar 2026 08:08:06 -0500
libpam-systemd:amd64, libsystemd0:amd64, libudev1:amd64, systemd, systemd-sysv, systemd-timesyncd, udev (built from systemd) updated from 249.11-0ubuntu3.17 to 249.11-0ubuntu3.20:
systemd (249.11-0ubuntu3.20) jammy; urgency=medium
* net_id: depending on new udev prop, include/exclude PCI domain from netif names
(LP: #2134334)
* network: support ID_NET_MANAGED_BY udev property
(LP: #2133220)
-- Robert Malz <robert.malz@canonical.com> Tue, 24 Mar 2026 09:52:29 -0400
systemd (249.11-0ubuntu3.19) jammy-security; urgency=medium
* SECURITY UPDATE: Local unprivileged user can overwrite stack in systemd
- d/p/CVE-2026-29111-1.patch: path-util: backport path_startswith_full
- d/p/CVE-2026-29111-2.patch: core/cgroup: avoid one unnecessary strjoina()
- d/p/CVE-2026-29111-3.patch: core: validate input cgroup path more prudently
* SECURITY UPDATE: Local root execution via malicious hardware devices
- d/p/udev-check-for-invalid-chars-in-various-fields-received-f.patch
- d/p/udev-fix-review-mixup.patch
- No CVE number
-- Nick Rosbrook <enr0n@ubuntu.com> Fri, 13 Mar 2026 12:47:41 -0400
tzdata (built from tzdata) updated from 2025b-0ubuntu0.22.04.1 to 2026a-0ubuntu0.22.04.1:
tzdata (2026a-0ubuntu0.22.04.1) jammy; urgency=medium
* New upstream release (LP: #2143355):
- No leap second on 2026-06-30
- Moldova has used EU transition times since 2022
* Add autopkgtest test case for 2025c and 2026a release
* Update the ICU timezone data to 2026a
* Add autopkgtest test case for ICU timezone data 2026a
-- Nadzeya Hutsko <nadzeya.hutsko@canonical.com> Thu, 19 Mar 2026 15:04:40 +0100
bsdutils, fdisk, libblkid1:amd64, libfdisk1:amd64, libmount1:amd64, libsmartcols1:amd64, libuuid1:amd64, mount, rfkill, util-linux (built from util-linux) updated from 1:2.37.2-4ubuntu3.4 to 1:2.37.2-4ubuntu3.5:
vim-common, vim-tiny, xxd (built from vim) updated from 2:8.2.3995-1ubuntu2.24 to 2:8.2.3995-1ubuntu2.26:
vim (2:8.2.3995-1ubuntu2.26) jammy-security; urgency=medium
* SECURITY UPDATE: Buffer Overflow
- debian/patches/CVE-2026-26269.patch: Limit writing to max KEYBUFLEN
bytes to prevent writing out of bounds.
- debian/patches/CVE-2026-28420.patch: Use VTERM_MAX_CHARS_PER_CELL * 4
for ga_grow() to ensure sufficient space. Add a boundary check to the
character loop to prevent index out-of-bounds access.
- debian/patches/CVE-2026-28422.patch: Update the size check to account
for the byte length of the fill character (using MB_CHAR2LEN).
- debian/patches/CVE-2026-25749.patch: Limit strncpy to the length
of the buffer (MAXPATHL)
- CVE-2026-26269
- CVE-2026-28420
- CVE-2026-28422
- CVE-2026-25749
* SECURITY UPDATE: Command Injection
- debian/patches/CVE-2026-28417.patch: Implement stricter RFC1123
hostname and IP validation. Use shellescape() for the provided
hostname and port.
- CVE-2026-28417
* SECURITY UPDATE: Out of Bounds Read
- debian/patches/CVE-2026-28418.patch: Check for end of buffer
and return early.
- CVE-2026-28418
* SECURITY UPDATE: Buffer Underflow
- debian/patches/CVE-2026-28419.patch: Add a check to ensure the
delimiter (p_7f) is not at the start of the buffer (lbuf) before
attempting to isolate the tag name.
- CVE-2026-28419
* SECURITY UPDATE: Denial of Service
- debian/patches/CVE-2026-28421.patch: Add bounds checks on
pe_page_count and pe_bnum against mf_blocknr_max before descending
into the block tree, and validate pe_old_lnum >= 1 and
pe_line_count > 0 before calling readfile().
- CVE-2026-28421
-- Bruce Cable <bruce.cable@canonical.com> Wed, 11 Mar 2026 10:44:44 +1100
wpasupplicant (built from wpa) updated from 2:2.10-6ubuntu2.3 to 2:2.10-6ubuntu2.4:
wpa (2:2.10-6ubuntu2.4) jammy; urgency=medium
* Add SaePasswordMismatch signal handling (LP: #2125203)
-- Mitchell Augustin <mitchell.augustin@canonical.com> Wed, 04 Feb 2026 17:33:00 -0600
25/02/2026, commit https://github.com/canonical/core-base/tree/35ba5381ea78d6904d4e5d475e1aee78f7b61172
[ Changes in the core22 snap ]
No detected changes for the core22 snap
[ Changes in primed packages ]
cloud-init (built from cloud-init) updated from 25.2-0ubuntu1~22.04.1 to 25.3-0ubuntu1~22.04.1:
cloud-init (25.3-0ubuntu1~22.04.1) jammy; urgency=medium
* d/p/retain-setuptools.patch: void upstream switch to meson build backend.
* refresh patches:
- d/p/cli-retain-file-argument-as-main-cmd-arg.patch
- d/p/grub-dpkg-support.patch
- d/p/no-nocloud-network.patch
- d/p/no-single-process.patch
* Upstream snapshot based on 25.3. (LP: #2131604).
List of changes from upstream can be found at
https://raw.githubusercontent.com/canonical/cloud-init/25.3/ChangeLog
-- Chad Smith <chad.smith@canonical.com> Sat, 15 Nov 2025 11:11:25 -0700
libexpat1:amd64 (built from expat) updated from 2.4.7-1ubuntu0.6 to 2.4.7-1ubuntu0.7:
expat (2.4.7-1ubuntu0.7) jammy-security; urgency=medium
* SECURITY UPDATE: NULL pointer dereference
- debian/patches/CVE-2026-24515.patch: updates
XML_ExternalEntityParserCreate to copy unknown encoding handler user
data in expat/lib/xmlparse.c.
- CVE-2026-24515
* SECURITY UPDATE: integer overflow
- debian/patches/CVE-2026-25210*.patch: adds an integer overflow check for
tag buffer reallocation in the doContent function of
expat/lib/xmlparse.c.
- CVE-2026-25210
-- Ian Constantin <ian.constantin@canonical.com> Wed, 04 Feb 2026 17:24:04 +0200
gcc-12-base:amd64, gcc-12-base:i386, libgcc-s1:amd64, libgcc-s1:i386, libstdc++6:amd64 (built from gcc-12) updated from 12.3.0-1ubuntu1~22.04.2 to 12.3.0-1ubuntu1~22.04.3:
gcc-12 (12.3.0-1ubuntu1~22.04.3) jammy; urgency=medium
* d/p/pr118976.diff: Fix memory corruption when executing 256-bit
Scalable Vector Extensions code on 128-bit CPUs (LP: #2101084).
-- Vladimir Petko <vladimir.petko@canonical.com> Sat, 20 Dec 2025 10:52:06 +1300
libglib2.0-0:amd64 (built from glib2.0) updated from 2.72.4-0ubuntu2.8 to 2.72.4-0ubuntu2.9:
glib2.0 (2.72.4-0ubuntu2.9) jammy-security; urgency=medium
* SECURITY UPDATE: integer overflow in Base64 encoding
- debian/patches/CVE-2026-1484-1.patch: use gsize to prevent potential
overflow in glib/gbase64.c.
- debian/patches/CVE-2026-1484-2.patch: ensure that the out value is
within allocated size in glib/gbase64.c.
- CVE-2026-1484
* SECURITY UPDATE: buffer underflow via header length
- debian/patches/CVE-2026-1485.patch: do not overflow if header is
longer than MAXINT in gio/gcontenttype.c.
- CVE-2026-1485
* SECURITY UPDATE: integer overflow via Unicode case conversion
- debian/patches/CVE-2026-1489-1.patch: use size_t for output_marks
length in glib/guniprop.c.
- debian/patches/CVE-2026-1489-2.patch: do not convert size_t to gint
in glib/guniprop.c.
- debian/patches/CVE-2026-1489-3.patch: ensure we do not overflow size
in glib/guniprop.c.
- debian/patches/CVE-2026-1489-4.patch: add test debug information when
parsing input files in glib/tests/unicode.c.
- CVE-2026-1489
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 28 Jan 2026 12:57:54 -0500
libc-bin, libc6:amd64, libc6:i386 (built from glibc) updated from 2.35-0ubuntu3.12 to 2.35-0ubuntu3.13:
glibc (2.35-0ubuntu3.13) jammy-security; urgency=medium
* SECURITY UPDATE: use-after-free in wordexp_t fields
- debian/patches/CVE-2025-15281.patch: posix: Reset wordexp_t fields
with WRDE_REUSE
- CVE-2025-15281
* SECURITY UPDATE: integer overflow in memalign
- debian/patches/CVE-2026-0861.patch: memalign: reinstate alignment
overflow check
- CVE-2026-0861
* SECURITY UPDATE: memory leak in NSS DNS
- debian/patches/CVE-2026-0915.patch: resolv: Fix NSS DNS backend for
getnetbyaddr
- CVE-2026-0915
-- Nishit Majithia <nishit.majithia@canonical.com> Fri, 30 Jan 2026 13:50:56 +0530
gnutls-bin, libgnutls30:amd64 (built from gnutls28) updated from 3.7.3-4ubuntu1.7 to 3.7.3-4ubuntu1.8:
gnutls28 (3.7.3-4ubuntu1.8) jammy-security; urgency=medium
* SECURITY UPDATE: DoS via malicious certificates
- debian/patches/CVE-2025-14831-*.patch: rework processing algorithms
to exhibit better performance characteristics in
lib/x509/name_constraints.c, tests/name-constraints-ip.c.
- CVE-2025-14831
* SECURITY UPDATE: stack overflow via long token label
- debian/patches/CVE-2025-9820.patch: avoid stack overwrite when
initializing a token in lib/pkcs11_write.c, tests/Makefile.am,
tests/pkcs11/long-label.c.
- CVE-2025-9820
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 10 Feb 2026 12:28:21 -0500
libpng16-16:amd64 (built from libpng1.6) updated from 1.6.37-3ubuntu0.3 to 1.6.37-3ubuntu0.4:
libpng1.6 (1.6.37-3ubuntu0.4) jammy-security; urgency=medium
* SECURITY UPDATE: OOB read in png_set_quantize()
- debian/patches/CVE-2026-25646.patch: fix a heap buffer overflow in
pngrtran.c.
- CVE-2026-25646
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 11 Feb 2026 09:27:33 -0500
libssh-4:amd64 (built from libssh) updated from 0.9.6-2ubuntu0.22.04.5 to 0.9.6-2ubuntu0.22.04.6:
libssh (0.9.6-2ubuntu0.22.04.6) jammy-security; urgency=medium
* SECURITY UPDATE: memory leak in key exchange
- debian/patches/CVE-2025-8277-1.patch: adjust packet filter to work
when DH-GEX is guessed wrongly in src/packet.c.
- debian/patches/CVE-2025-8277-2.patch: fix memory leak of unused
ephemeral key pair after client's wrong KEX guess in src/dh_crypto.c,
src/dh_key.c, src/ecdh_crypto.c, src/ecdh_gcrypt.c,
src/ecdh_mbedcrypto.c.
- debian/patches/CVE-2025-8277-3.patch: free previously allocated
pubkeys in src/ecdh_crypto.c, src/ecdh_gcrypt.c.
- debian/patches/CVE-2025-8277-4.patch: avoid leaking ecdh keys in
src/ecdh_mbedcrypto.c, src/wrapper.c.
- CVE-2025-8277
* SECURITY UPDATE: Improper sanitation of paths received from SCP servers
- debian/patches/CVE-2026-0964.patch: reject invalid paths received
through scp in src/scp.c.
- CVE-2026-0964
* SECURITY UPDATE: DoS via improper configuration file handling
- debian/patches/CVE-2026-0965.patch: do not attempt to read
non-regular and too large configuration files in
include/libssh/misc.h, include/libssh/priv.h, src/bind_config.c,
src/config.c, src/dh-gex.c, src/known_hosts.c, src/knownhosts.c,
src/misc.c, tests/unittests/torture_config.c.
- CVE-2026-0965
* SECURITY UPDATE: Buffer underflow in ssh_get_hexa() on invalid input
- debian/patches/CVE-2026-0966-1.patch: avoid heap buffer underflow in
ssh_get_hexa in src/misc.c.
- debian/patches/CVE-2026-0966-2.patch: test coverage for ssh_get_hexa
in tests/unittests/torture_misc.c.
- debian/patches/CVE-2026-0966-3.patch: update guided tour to use
SHA256 fingerprints in doc/guided_tour.dox.
- CVE-2026-0966
* SECURITY UPDATE: DoS via inefficient regular expression processing
- debian/patches/CVE-2026-0967.patch: avoid recursive matching (ReDoS)
in src/match.c, tests/unittests/torture_config.c.
- CVE-2026-0967
* SECURITY UPDATE: DoS due to malformed SFTP message
- debian/patches/CVE-2026-0968-1.patch: sanitize input handling in
sftp_parse_longname() in src/sftp.c.
- debian/patches/CVE-2026-0968-2.patch: reproducer for invalid longname
data in tests/unittests/CMakeLists.txt,
tests/unittests/torture_unit_sftp.c.
- CVE-2026-0968
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Fri, 13 Feb 2026 10:22:49 -0500
libpython3.10-minimal:amd64, libpython3.10-stdlib:amd64, python3.10, python3.10-minimal (built from python3.10) updated from 3.10.12-1~22.04.13 to 3.10.12-1~22.04.14:
python3.10 (3.10.12-1~22.04.14) jammy-security; urgency=medium
* SECURITY UPDATE: Header injection in email messages where addresses are not
sanitized.
- debian/patches/CVE-2025-11468.patch: Add escape parentheses and backslash
in Lib/email/_header_value_parser.py. Add test in
Lib/test/test_email/test__header_value_parser.py.
- CVE-2025-11468
* SECURITY UPDATE: Quadratic algorithm when building excessively nested XML
documents.
- debian/patches/CVE-2025-12084-*.patch: Remove _in_document and replace
with node.ownerDocument in Lib/xml/dom/minidom.py. Set self.ownerDocument
to None in Lib/xml/dom/minidom.py. Add test in Lib/test/test_minidom.py.
- CVE-2025-12084
* SECURITY UPDATE: OOM and denial of service when opening malicious plist
file.
- debian/patches/CVE-2025-13837.patch: Add _MIN_READ_BUF_SIZE and _read
with checks in Lib/plistlib.py. Add test in Lib/test/test_plistlib.py.
- CVE-2025-13837
* SECURITY UPDATE: Header injection in user controlled data URLs in urllib.
- debian/patches/CVE-2025-15282.patch: Add control character checks in
Lib/urllib/request.py. Add test in Lib/test/test_urllib.py.
* SECURITY UPDATE: Command injection through user controlled commands in
imaplib.
- debian/patches/CVE-2025-15366.patch: Add _control_chars and checks in
Lib/imaplib.py. Add test in Lib/test/test_imaplib.py.
* SECURITY UPDATE: Command injection through user controlled commands in
poplib.
- debian/patches/CVE-2025-15367.patch: Add control character regex check
in Lib/poplib.py. Add test in Lib/test/test_poplib.py.
- CVE-2025-15367
* SECURITY UPDATE: HTTP header injection in user controlled cookie values.
- debian/patches/CVE-2026-0672.patch: Add _control_characters_re and
checks in Lib/http/cookies.py. Add test in Lib/test/test_http_cookies.py.
- CVE-2026-0672
* SECURITY UPDATE: HTTP header injection in user controlled headers and
values with newlines.
- debian/patches/CVE-2026-0865.patch: Add _control_chars_re and check in
Lib/wsgiref/headers.py. Add test in Lib/test/support/__init__.py and
Lib/test/test_wsgiref.py.
- CVE-2026-0865
-- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> Mon, 26 Jan 2026 11:25:28 -0330
28/01/2026, commit https://github.com/canonical/core-base/tree/35ba5381ea78d6904d4e5d475e1aee78f7b61172
[ Changes in the core22 snap ]
No detected changes for the core22 snap
[ Changes in primed packages ]
libglib2.0-0:amd64 (built from glib2.0) updated from 2.72.4-0ubuntu2.7 to 2.72.4-0ubuntu2.8:
glib2.0 (2.72.4-0ubuntu2.8) jammy-security; urgency=medium
* SECURITY UPDATE: Integer overflow in g_buffered_input_stream_peek()
- debian/patches/CVE-2026-0988.patch: fix a potential integer overflow
in peek() in gio/gbufferedinputstream.c,
gio/tests/buffered-input-stream.c.
- CVE-2026-0988
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 20 Jan 2026 08:55:03 -0500
libc-bin, libc6:amd64, libc6:i386 (built from glibc) updated from 2.35-0ubuntu3.11 to 2.35-0ubuntu3.12:
glibc (2.35-0ubuntu3.12) jammy; urgency=medium
* d/p/lp2089789-*.patch: fix malloc performance regression (LP: #2089789)
-- Simon Chopin <schopin@ubuntu.com> Tue, 15 Jul 2025 11:40:00 +0200
libpng16-16:amd64 (built from libpng1.6) updated from 1.6.37-3ubuntu0.1 to 1.6.37-3ubuntu0.3:
libpng1.6 (1.6.37-3ubuntu0.3) jammy-security; urgency=medium
* SECURITY UPDATE: OOB in png_image_read_composite
- debian/patches/CVE-2025-66293-1.patch: validate component size in
pngread.c.
- debian/patches/CVE-2025-66293-2.patch: improve fix in pngread.c.
- CVE-2025-66293
* SECURITY UPDATE: Heap buffer over-read in png_image_read_direct_scaled
- debian/patches/CVE-2026-22695.patch: fix memcpy size in pngread.c.
- CVE-2026-22695
* SECURITY UPDATE: Integer truncation causing heap buffer over-read
- debian/patches/CVE-2026-22801.patch: remove incorrect truncation
casts in CMakeLists.txt, contrib/libtests/pngstest.c, pngwrite.c,
tests/pngstest-large-stride.
- CVE-2026-22801
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 12 Jan 2026 13:14:59 -0500
libssl3:amd64, openssl (built from openssl) updated from 3.0.2-0ubuntu1.20 to 3.0.2-0ubuntu1.21:
openssl (3.0.2-0ubuntu1.21) jammy-security; urgency=medium
* SECURITY UPDATE: Stack buffer overflow in CMS AuthEnvelopedData parsing
- debian/patches/CVE-2025-15467-1.patch: correct handling of
AEAD-encrypted CMS with inadmissibly long IV in crypto/evp/evp_lib.c.
- debian/patches/CVE-2025-15467-2.patch: some comments to clarify
functions usage in crypto/asn1/evp_asn1.c.
- debian/patches/CVE-2025-15467-3.patch: test for handling of
AEAD-encrypted CMS with inadmissibly long IV in test/cmsapitest.c,
test/recipes/80-test_cmsapi.t,
test/recipes/80-test_cmsapi_data/encDataWithTooLongIV.pem.
- CVE-2025-15467
* SECURITY UPDATE: Heap out-of-bounds write in BIO_f_linebuffer on short
writes
- debian/patches/CVE-2025-68160.patch: fix heap buffer overflow in
BIO_f_linebuffer in crypto/bio/bf_lbuf.c.
- CVE-2025-68160
* SECURITY UPDATE: Unauthenticated/unencrypted trailing bytes with
low-level OCB function calls
- debian/patches/CVE-2025-69418.patch: fix OCB AES-NI/HW stream path
unauthenticated/unencrypted trailing bytes in crypto/modes/ocb128.c.
- CVE-2025-69418
* SECURITY UPDATE: Out of bounds write in PKCS12_get_friendlyname() UTF-8
conversion
- debian/patches/CVE-2025-69419.patch: check return code of UTF8_putc
in crypto/asn1/a_strex.c, crypto/pkcs12/p12_utl.c.
- CVE-2025-69419
* SECURITY UPDATE: Missing ASN1_TYPE validation in
TS_RESP_verify_response() function
- debian/patches/CVE-2025-69420.patch: verify ASN1 object's types
before attempting to access them as a particular type in
crypto/ts/ts_rsp_verify.c.
- CVE-2025-69420
* SECURITY UPDATE: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex
- debian/patches/CVE-2025-69421.patch: add NULL check in
crypto/pkcs12/p12_decr.c.
- CVE-2025-69421
* SECURITY UPDATE: ASN1_TYPE missing validation and type confusion
- debian/patches/CVE-2026-2279x.patch: ensure ASN1 types are checked
before use in apps/s_client.c, crypto/pkcs12/p12_kiss.c,
crypto/pkcs7/pk7_doit.c.
- CVE-2026-22795
- CVE-2026-22796
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Mon, 26 Jan 2026 07:32:08 -0500
python3-urllib3 (built from python-urllib3) updated from 1.26.5-1~exp1ubuntu0.5 to 1.26.5-1~exp1ubuntu0.6:
python-urllib3 (1.26.5-1~exp1ubuntu0.6) jammy-security; urgency=medium
* SECURITY REGRESSION: Missing _has_decoded_content from CVE-2026-21441
(LP: #2138420)
- debian/patches/CVE-2026-21441-fix1.patch: Implement _has_decoded_content
and decoded checks in src/urllib3/response.py. Add tests in
test/test_response.py.
-- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> Fri, 16 Jan 2026 19:39:26 -0330
13/01/2026, commit https://github.com/canonical/core-base/tree/35ba5381ea78d6904d4e5d475e1aee78f7b61172
[ Changes in the core22 snap ]
Philip Meulengracht (1):
static: add snapd.conf to tmpfiles.d (#383)
[ Changes in primed packages ]
apparmor, libapparmor1:amd64 (built from apparmor) updated from 3.0.4-2ubuntu2.4 to 3.0.4-2ubuntu2.5:
apparmor (3.0.4-2ubuntu2.5) jammy; urgency=medium
* profiles: make /sys/devices PCI paths hex-aware (LP: #2115234)
-- Keifer Snedeker <keifer.snedeker@canonical.com> Fri, 15 Aug 2025 13:17:13 +0100
libglib2.0-0:amd64 (built from glib2.0) updated from 2.72.4-0ubuntu2.6 to 2.72.4-0ubuntu2.7:
glib2.0 (2.72.4-0ubuntu2.7) jammy-security; urgency=medium
* SECURITY UPDATE: overflow via long invalid ISO 8601 timestamp
- debian/patches/CVE-2025-3360-1.patch: fix integer overflow when
parsing very long ISO8601 inputs in glib/gdatetime.c.
- debian/patches/CVE-2025-3360-2.patch: fix potential integer overflow
in timezone offset handling in glib/gdatetime.c.
- debian/patches/CVE-2025-3360-3.patch: track timezone length as an
unsigned size_t in glib/gdatetime.c.
- debian/patches/CVE-2025-3360-4.patch: factor out some string pointer
arithmetic in glib/gdatetime.c.
- debian/patches/CVE-2025-3360-5.patch: factor out an undersized
variable in glib/gdatetime.c.
- debian/patches/CVE-2025-3360-6.patch: add some missing GDateTime
ISO8601 parsing tests in glib/tests/gdatetime.c.
- CVE-2025-3360
* SECURITY UPDATE: GString overflow
- debian/patches/CVE-2025-6052.patch: fix overflow check when expanding
the string in glib/gstring.c.
- CVE-2025-6052
* SECURITY UPDATE: integer overflow in temp file creation
- debian/patches/CVE-2025-7039.patch: fix computation of temporary file
name in glib/gfileutils.c.
- CVE-2025-7039
* SECURITY UPDATE: heap overflow in g_escape_uri_string()
- debian/patches/CVE-2025-13601.patch: add overflow check in
glib/gconvert.c.
- CVE-2025-13601
* SECURITY UPDATE: buffer underflow through glib/gvariant
- debian/patches/CVE-2025-14087-1.patch: fix potential integer overflow
parsing (byte)strings in glib/gvariant-parser.c.
- debian/patches/CVE-2025-14087-2.patch: use size_t to count numbers of
child elements in glib/gvariant-parser.c.
- debian/patches/CVE-2025-14087-3.patch: convert error handling code to
use size_t in glib/gvariant-parser.c.
- CVE-2025-14087
* SECURITY UPDATE: integer overflow in gfileattribute
- debian/patches/gfileattribute-overflow.patch: add overflow check in
gio/gfileattribute.c.
- No CVE number
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 10 Dec 2025 11:09:12 -0500
gpgv (built from gnupg2) updated from 2.2.27-3ubuntu2.4 to 2.2.27-3ubuntu2.5:
gnupg2 (2.2.27-3ubuntu2.5) jammy-security; urgency=medium
* SECURITY UPDATE: Remote Code Execution
- debian/patches/CVE-2025-68973.patch: gpg: Fix possible memory
corruption in the armor parser.
- CVE-2025-68973
-- Allen Huang <allen.huang@canonical.com> Mon, 05 Jan 2026 22:14:39 +0000
libpng16-16:amd64 (built from libpng1.6) updated from 1.6.37-3build5 to 1.6.37-3ubuntu0.1:
libpng1.6 (1.6.37-3ubuntu0.1) jammy-security; urgency=medium
* SECURITY UPDATE: buffer overflow issue
- debian/patches/CVE-2025-64505.patch: Fix a buffer overflow in
png_do_quantize
- debian/patches/CVE-2025-64506.patch: Fix a heap buffer overflow in
png_write_image_8bit
- debian/patches/CVE-2025-64720.patch: Fix a buffer overflow in
png_init_read_transformations
- debian/patches/CVE-2025-65018.patch: Fix a heap buffer overflow in
png_image_finish_read
- CVE-2025-64505
- CVE-2025-64506
- CVE-2025-64720
- CVE-2025-65018
-- Nishit Majithia <nishit.majithia@canonical.com> Tue, 09 Dec 2025 17:35:45 +0530
libtasn1-6:amd64 (built from libtasn1-6) updated from 4.18.0-4ubuntu0.1 to 4.18.0-4ubuntu0.2:
libtasn1-6 (4.18.0-4ubuntu0.2) jammy-security; urgency=medium
* SECURITY UPDATE: ETYPE_OK off-by-one array size check
- debian/patches/CVE-2021-46848.patch: fix size check in lib/int.h.
- CVE-2021-46848
* SECURITY UPDATE: Stack-based buffer overflow
- debian/patches/CVE-2025-13151.patch: fix asn1_expand_octet_string
buffer size in lib/decoding.c.
- CVE-2025-13151
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Thu, 08 Jan 2026 12:27:15 -0500
python3-attr (built from python-attrs) updated from 21.2.0-1 to 21.2.0-1ubuntu1:
python-attrs (21.2.0-1ubuntu1) jammy; urgency=medium
* d/p/0005-Rework-linecache-handling-828.patch: Cherry-pick upstream PR 826
- Fix memory leak when creating many identical classes (Fixes LP: #2121607)
-- Zachary Raines <zachary.raines@canonical.com> Mon, 06 Oct 2025 15:28:54 +0000
python3-urllib3 (built from python-urllib3) updated from 1.26.5-1~exp1ubuntu0.3 to 1.26.5-1~exp1ubuntu0.5:
python-urllib3 (1.26.5-1~exp1ubuntu0.5) jammy-security; urgency=medium
* SECURITY UPDATE: Decompression bomb in HTTP redirect responses.
- debian/patches/CVE-2026-21441.patch: Add decode_content to self.read()
in src/urllib3/response.py. Add tests in
test/with_dummyserver/test_connectionpool.py.
- CVE-2026-21441
-- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> Thu, 08 Jan 2026 16:06:10 -0330
python-urllib3 (1.26.5-1~exp1ubuntu0.4) jammy-security; urgency=medium
* SECURITY UPDATE: Denial of service due to unbounded decompression chain.
- debian/patches/CVE-2025-66418.patch: Add max_decode_links limit and
checks in src/urllib3/response.py. Add test in test/test_response.py.
- CVE-2025-66418
-- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> Wed, 10 Dec 2025 17:29:42 -0330
libpython3.10-minimal:amd64, libpython3.10-stdlib:amd64, python3.10, python3.10-minimal (built from python3.10) updated from 3.10.12-1~22.04.12 to 3.10.12-1~22.04.13:
python3.10 (3.10.12-1~22.04.13) jammy-security; urgency=medium
* SECURITY UPDATE: HTTP Content-Length denial of service
- debian/patches/CVE-2025-13836.patch: Read large data in chunks with
geometric reads in Lib/http/client.py and add tests in
Lib/test/test_httplib.py
- CVE-2025-13836
-- Vyom Yadav <vyom.yadav@canonical.com> Thu, 08 Jan 2026 12:22:19 +0530
02/12/2025, commit https://github.com/canonical/core-base/tree/e66d98a0d2aa893b0907dd3bbe9db09c3d274c5d
[ Changes in the core22 snap ]
No detected changes for the core22 snap
[ Changes in primed packages ]
libpython3.10-minimal:amd64, libpython3.10-stdlib:amd64, python3.10, python3.10-minimal (built from python3.10) updated from 3.10.12-1~22.04.11 to 3.10.12-1~22.04.12:
python3.10 (3.10.12-1~22.04.12) jammy-security; urgency=medium
* SECURITY UPDATE: Possible payload obfuscation
- debian/patches/CVE-2025-8291.patch: check consistency of
the zip64 end of central dir record in Lib/zipfile.py,
Lib/test/test_zipfile.py.
- CVE-2025-8291
* SECURITY UPDATE: Performance degradation
- debian/patches/CVE-2025-6075.patch: fix quadratic complexity
in os.path.expandvars() in Lib/ntpatch.py, Lib/posixpath.py,
Lib/test/test_genericpatch.py, Lib/test/test_npath.py.
- CVE-2025-6075
-- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com> Tue, 04 Nov 2025 05:48:33 -0300
05/11/2025, commit https://github.com/canonical/core-base/tree/e66d98a0d2aa893b0907dd3bbe9db09c3d274c5d
[ Changes in the core22 snap ]
Philip Meulengracht (1):
github: add fips release builds (#378)
[ Changes in primed packages ]
distro-info-data (built from distro-info-data) updated from 0.52ubuntu0.9 to 0.52ubuntu0.11:
distro-info-data (0.52ubuntu0.11) jammy; urgency=medium
* ubuntu.csv: remove eol-legacy field from resolute
This version of distro-info does not know about eol-legacy.
-- Nick Rosbrook <enr0n@ubuntu.com> Fri, 10 Oct 2025 11:59:51 -0400
distro-info-data (0.52ubuntu0.10) jammy; urgency=medium
* Add Ubuntu 26.04 LTS "Resolute Raccoon" (LP: #2126961)
* Correct date for forky
* Correct estimation for trixie ELTS EoL to 10 years total support.
* Update the bookworm EoL
-- Florent 'Skia' Jacquet <florent.jacquet@canonical.com> Fri, 10 Oct 2025 11:33:51 +0100
libssh-4:amd64 (built from libssh) updated from 0.9.6-2ubuntu0.22.04.4 to 0.9.6-2ubuntu0.22.04.5:
libssh (0.9.6-2ubuntu0.22.04.5) jammy-security; urgency=medium
* SECURITY UPDATE: NULL pointer dereference
- debian/patches/CVE-2025-8114.patch: sets rc to SSH_ERROR prior to goto
error in ssh_make_sessionid() of src/kex.c.
- CVE-2025-8114
-- Ian Constantin <ian.constantin@canonical.com> Wed, 29 Oct 2025 14:58:26 +0200
09/10/2025, commit https://github.com/canonical/core-base/tree/6174ae97e09857c5e7e38f2a0599c7d2940acddf
[ Changes in the core22 snap ]
No detected changes for the core22 snap
[ Changes in primed packages ]
cloud-init (built from cloud-init) updated from 25.1.4-0ubuntu0~22.04.1 to 25.2-0ubuntu1~22.04.1:
cloud-init (25.2-0ubuntu1~22.04.1) jammy; urgency=medium
* refresh patches
- d/p/cli-retain-file-argument-as-main-cmd-arg.patch
- d/p/deprecation-version-boundary.patch
- d/p/grub-dpkg-support.patch
- d/p/keep-dhclient-as-priority-client.patch
- d/p/no-nocloud-network.patch
- d/p/no-remove-networkd-online.patch
- d/p/no-single-process.patch
- d/p/retain-ec2-default-net-update-events.patch
- d/p/retain-old-groups.patch
- d/p/revert-551f560d-cloud-config-after-snap-seeding.patch
* add d/p/strip-invalid-mtu.patch
- Provides backwards compatibility for an other invalid
MTU in a netplan config. (GH-6239)
* Upstream snapshot based on 25.2. (LP: #2120495).
List of changes from upstream can be found at
https://raw.githubusercontent.com/canonical/cloud-init/25.2/ChangeLog
-- James Falcon <james.falcon@canonical.com> Tue, 12 Aug 2025 14:48:04 -0500
dpkg (built from dpkg) updated from 1.21.1ubuntu2.3 to 1.21.1ubuntu2.6:
dpkg (1.21.1ubuntu2.6) jammy-security; urgency=medium
[ Joy Latten ]
* SECURITY UPDATE:
- Fix cleanup for control member with restricted directories. LP: #2122053
- Fixes CVE-2025-6297
-- Serge Hallyn <serge.hallyn@ubuntu.com> Tue, 09 Sep 2025 15:09:16 -0500
libssl3:amd64, openssl (built from openssl) updated from 3.0.2-0ubuntu1.19 to 3.0.2-0ubuntu1.20:
openssl (3.0.2-0ubuntu1.20) jammy-security; urgency=medium
* SECURITY UPDATE: Out-of-bounds read & write in RFC 3211 KEK Unwrap
- debian/patches/CVE-2025-9230.patch: fix incorrect check of unwrapped
key size in crypto/cms/cms_pwri.c.
- CVE-2025-9230
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Thu, 18 Sep 2025 08:06:16 -0400
libpam-systemd:amd64, libsystemd0:amd64, libudev1:amd64, systemd, systemd-sysv, systemd-timesyncd, udev (built from systemd) updated from 249.11-0ubuntu3.16 to 249.11-0ubuntu3.17:
systemd (249.11-0ubuntu3.17) jammy; urgency=medium
[ Nick Rosbrook ]
* initramfs-tools: copy hwdb.bin to initramfs (LP: #2112237)
* d/t/tests-in-lxd: drop patching workaround (LP: #2115263)
- d/t/control: add Depends: dnsmasq-base
(Revealed by test progressing past previous failure)
[ Chengen Du ]
* core/device: fix devlink handling (LP: #2100252)
-- Nick Rosbrook <enr0n@ubuntu.com> Tue, 26 Aug 2025 11:23:06 -0400
wpasupplicant (built from wpa) updated from 2:2.10-6ubuntu2.2 to 2:2.10-6ubuntu2.3:
wpa (2:2.10-6ubuntu2.3) jammy; urgency=medium
* Bump DEFAULT_BSS_MAX_COUNT to 1000 (LP: #2117180)
-- Mitchell Augustin <mitchell.augustin@canonical.com> Mon, 21 Jul 2025 18:13:31 -0500
23/09/2025, commit https://github.com/canonical/core-base/tree/6174ae97e09857c5e7e38f2a0599c7d2940acddf
[ Changes in the core22 snap ]
No detected changes for the core22 snap
[ Changes in primed packages ]
libc-bin, libc6:amd64, libc6:i386 (built from glibc) updated from 2.35-0ubuntu3.10 to 2.35-0ubuntu3.11:
glibc (2.35-0ubuntu3.11) jammy-security; urgency=medium
* SECURITY UPDATE: double-free in regcomp function
- debian/patches/any/CVE-2025-8058.patch: fix double-free after
allocation failure in regcomp in posix/Makefile, posix/regcomp.c,
posix/tst-regcomp-bracket-free.c.
- CVE-2025-8058
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 17 Sep 2025 11:26:08 -0400
22/08/2025, commit https://github.com/canonical/core-base/tree/6174ae97e09857c5e7e38f2a0599c7d2940acddf
[ Changes in the core22 snap ]
Alfonso Sánchez-Beato (3):
.github/workflows: add release-manual action
.github/workflows/tests.yaml: make sure to run on spread-enabled runners
many: ser snap version from date tag if present
[ Changes in primed packages ]
gcc-12-base:amd64, gcc-12-base:i386, libgcc-s1:amd64, libgcc-s1:i386, libstdc++6:amd64 (built from gcc-12) updated from 12.3.0-1ubuntu1~22.04 to 12.3.0-1ubuntu1~22.04.2:
gcc-12 (12.3.0-1ubuntu1~22.04.2) jammy-security; urgency=medium
* SECURITY UPDATE: A missed hardening option in -fstack-protector for AArch64
can lead to buffer overflows for dynamically allocated local variables
not being detected. (LP: #2054343)
- d/p/CVE-2023-4039.diff: Address stack protector and stack clash
protection weaknesses on AArch64. Taken from the gcc-12 branch.
- CVE-2023-4039
* Move allocator base to avoid conflict with high-entropy ASLR for x86-64
Linux. Patch taken from LLVM. Fixes ftbfs. (LP: #2107313)
- d/p/lp2107313-asan-allocator-base.diff
* aarch64: Fix loose ldpstp check. (LP: #2116909)
- d/p/lp2116909-aarch64-fix-loose-ldpstp-check.diff
-- Gerald Yang <gerald.yang@canonical.com> Tue, 15 Jul 2025 03:45:40 +0000
libglib2.0-0:amd64 (built from glib2.0) updated from 2.72.4-0ubuntu2.5 to 2.72.4-0ubuntu2.6:
glib2.0 (2.72.4-0ubuntu2.6) jammy; urgency=medium
* Fix crash due to infinite recursion in MIME subclassing (LP: #2097496)
-- Alessandro Astone <alessandro.astone@canonical.com> Fri, 20 Jun 2025 15:38:50 +0200
libpython3.10-minimal:amd64, libpython3.10-stdlib:amd64, python3.10, python3.10-minimal (built from python3.10) updated from 3.10.12-1~22.04.10 to 3.10.12-1~22.04.11:
python3.10 (3.10.12-1~22.04.11) jammy-security; urgency=medium
* SECURITY UPDATE: Regular expression denial of service.
- debian/patches/CVE-2025-6069.patch: Improve regex parsing in
Lib/html/parser.py.
- CVE-2025-6069
* SECURITY UPDATE: Infinite loop when parsing tar archives.
- debian/patches/CVE-2025-8194.patch: Raise exception when count < 0 in
Lib/tarfile.py.
- CVE-2025-8194
-- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> Fri, 15 Aug 2025 12:02:43 -0230
30/07/2025, commit https://git.launchpad.net/snap-core22/tree/5915fa29307f6839820c681cf666367c164d1088
[ Changes in the core22 snap ]
No detected changes for the core22 snap
[ Changes in primed packages ]
cloud-init (built from cloud-init) updated from 25.1.2-0ubuntu0~22.04.2 to 25.1.4-0ubuntu0~22.04.1:
cloud-init (25.1.4-0ubuntu0~22.04.1) jammy-security; urgency=medium
* refresh patches:
- d/p/revert-usr-lib-systemd-units.patch
* Upstream snapshot based on 25.1.4.
List of changes from upstream can be found at
https://raw.githubusercontent.com/canonical/cloud-init/25.1.4/ChangeLog
- Bugs fixed in this snapshot:
+ fix: disable cloud-init when non-x86 environments have no DMI-data
and no strict datasources detected (LP: #2069607) (CVE-2024-6174)
-- Chad Smith <chad.smith@canonical.com> Tue, 24 Jun 2025 15:15:25 -0600
cloud-init (25.1.3-0ubuntu0~22.04.1) jammy-security; urgency=medium
* d/cloud-init-base.postinst: move existing hotplug-cmd fifo to root-only
share dir (CVE-2024-11584)
* Upstream security bugfix release based on 25.1.3.
List of changes from upstream can be found at
https://raw.githubusercontent.com/canonical/cloud-init/25.1.3/ChangeLog
- Bugs fixed in this snapshot:
- security: make hotplug socket only writable by root (LP: #2114229)
(CVE-2024-11584)
- security: make ds-identify behavior strict datasource discovery on
non-x86 platforms without DMI data (LP: #2069607) (CVE-2024-6174)
-- Chad Smith <chad.smith@canonical.com> Thu, 12 Jun 2025 20:28:18 -0600
gnutls-bin, libgnutls30:amd64 (built from gnutls28) updated from 3.7.3-4ubuntu1.6 to 3.7.3-4ubuntu1.7:
gnutls28 (3.7.3-4ubuntu1.7) jammy-security; urgency=medium
* SECURITY UPDATE: double-free via otherName in the SAN
- debian/patches/CVE-2025-32988.patch: avoid double free when exporting
othernames in SAN in lib/x509/extensions.c.
- CVE-2025-32988
* SECURITY UPDATE: OOB read via malformed length field in SCT extension
- debian/patches/CVE-2025-32989.patch: fix read buffer overrun in SCT
timestamps in lib/x509/x509_ext.c.
- CVE-2025-32989
* SECURITY UPDATE: heap write overflow in certtool via invalid template
- debian/patches/CVE-2025-32990.patch: avoid 1-byte write buffer
overrun when parsing template in src/certtool-cfg.c,
tests/cert-tests/Makefile.am, tests/cert-tests/template-test.sh,
tests/cert-tests/templates/template-too-many-othernames.tmpl.
- CVE-2025-32990
* SECURITY UPDATE: NULL deref via missing PSK in TLS 1.3 handshake
- debian/patches/CVE-2025-6395.patch: clear HSK_PSK_SELECTED when
resetting binders in lib/handshake.c, lib/state.c, tests/Makefile.am,
tests/tls13/hello_retry_request_psk.c.
- CVE-2025-6395
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Fri, 11 Jul 2025 09:13:17 -0400
iputils-ping (built from iputils) updated from 3:20211215-1 to 3:20211215-1ubuntu0.1:
iputils (3:20211215-1ubuntu0.1) jammy-security; urgency=medium
* SECURITY UPDATE: DoS via crafted ICMP Echo Reply packet
- debian/patches/CVE-2025-47268: fix signed 64-bit integer overflow in
RTT calculation in iputils_common.h, ping/ping_common.c.
- debian/patches/CVE-2025-48964.patch: fix moving average rtt
calculation in iputils_common.h, ping/ping.h, ping/ping_common.c.
- CVE-2025-47268
- CVE-2025-48964
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Thu, 24 Jul 2025 07:51:44 -0400
perl-base (built from perl) updated from 5.34.0-3ubuntu1.4 to 5.34.0-3ubuntu1.5:
perl (5.34.0-3ubuntu1.5) jammy-security; urgency=medium
* SECURITY UPDATE: threads race condition in file operations
- debian/patches/fixes/CVE-2025-40909-metaconfig.diff: check for
fdopendir in regen-configure/U/perl/d_fdopendir.U.
- debian/patches/fixes/CVE-2025-40909-1.diff: clone dirhandles without
fchdir in Configure, Cross/config.sh-arm-linux,
Cross/config.sh-arm-linux-n770, Porting/Glossary, Porting/config.sh,
config_h.SH, configure.com, plan9/config_sh.sample, sv.c,
t/op/threads-dirh.t, win32/config.gc, win32/config.vc.
- debian/patches/fixes/CVE-2025-40909-2.diff: minor corrections in
Cross/config.sh-arm-linux, Cross/config.sh-arm-linux-n770,
config_h.SH,plan9/config_sh.sample.
- debian/patches/fixes/CVE-2025-40909-3.diff: use PerlLIO_dup_cloexec
in Perl_dirp_dup to set O_CLOEXEC in sv.c.
- debian/patches/fixes/CVE-2025-40909-metaconfig-reorder.diff: slightly
reorder Configure and config_h.SH to match metaconfig output in
Configure, config_h.SH.
- debian/patches/fixes/CVE-2025-40909-generated.diff: update generated
files and checksums in uconfig.sh, uconfig64.sh, uconfig.h,
NetWare/config.wc.
- CVE-2025-40909
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Fri, 25 Jul 2025 13:26:40 -0400
libsqlite3-0:amd64 (built from sqlite3) updated from 3.37.2-2ubuntu0.4 to 3.37.2-2ubuntu0.5:
sqlite3 (3.37.2-2ubuntu0.5) jammy-security; urgency=medium
* SECURITY UPDATE: Memory corruption via number of aggregate terms
- debian/patches/CVE-2025-6965.patch: raise an error right away if the
number of aggregate terms in a query exceeds the maximum number of
columns in src/expr.c, src/sqliteInt.h.
- CVE-2025-6965
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Fri, 18 Jul 2025 11:17:24 -0400
08/07/2025, commit https://git.launchpad.net/snap-core22/tree/5915fa29307f6839820c681cf666367c164d1088
[ Changes in the core22 snap ]
Philip Meulengracht (1):
tools: aggregate old changelogs
[ Changes in primed packages ]
gpgv (built from gnupg2) updated from 2.2.27-3ubuntu2.3 to 2.2.27-3ubuntu2.4:
gnupg2 (2.2.27-3ubuntu2.4) jammy-security; urgency=medium
* debian/patches/fix-key-validity-regression-due-to-CVE-2025-
30258.patch:
- Fix a key validity regression following patches for CVE-2025-30258,
causing trusted "certify-only" primary keys to be ignored when checking
signature on user IDs and computing key validity. This regression makes
imported keys signed by a trusted "certify-only" key have an unknown
validity (LP: #2114775).
-- dcpi <dcpi@u22vm> Wed, 25 Jun 2025 13:54:28 +0000
libssh-4:amd64 (built from libssh) updated from 0.9.6-2ubuntu0.22.04.3 to 0.9.6-2ubuntu0.22.04.4:
libssh (0.9.6-2ubuntu0.22.04.4) jammy-security; urgency=medium
* SECURITY UPDATE: Write beyond bounds in binary to base64 conversion
functions
- debian/patches/CVE-2025-4877.patch: prevent integer overflow and
potential OOB.
- CVE-2025-4877
* SECURITY UPDATE: Use of uninitialized variable in
privatekey_from_file()
- debian/patches/CVE-2025-4878-1.patch: initialize pointers where
possible.
- debian/patches/CVE-2025-4878-2.patch: properly check return value to
avoid NULL pointer dereference.
- CVE-2025-4878
* SECURITY UPDATE: OOB read in sftp_handle function
- debian/patches/CVE-2025-5318.patch: fix possible buffer overrun.
- CVE-2025-5318
* SECURITY UPDATE: ssh_kdf() returns a success code on certain failures
- debian/patches/CVE-2025-5372-pre1.patch: Reformat ssh_kdf().
- debian/patches/CVE-2025-5372.patch: simplify error checking and
handling of return codes in ssh_kdf().
- CVE-2025-5372
* SECURITY UPDATE: Missing packet filter may expose to variant of
Terrapin attack
- debian/patches/missing_packet_filter.patch: implement missing packet
filter for DH GEX.
- No CVE number
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 02 Jul 2025 14:48:47 -0400
libpam-modules-bin, libpam-modules:amd64, libpam-runtime, libpam0g:amd64 (built from pam) updated from 1.4.0-11ubuntu2.5 to 1.4.0-11ubuntu2.6:
pam (1.4.0-11ubuntu2.6) jammy-security; urgency=medium
* SECURITY UPDATE: privilege escalation via pam_namespace
- debian/patches-applied/pam_namespace_170.patch: sync pam_namespace
module to version 1.7.0.
- debian/patches-applied/pam_namespace_post170-*.patch: add post-1.7.0
changes from upstream git tree.
- debian/patches-applied/pam_namespace_revert_abi.patch: revert ABI
change to prevent unintended issues in running daemons.
- debian/patches-applied/CVE-2025-6020-1.patch: fix potential privilege
escalation.
- debian/patches-applied/CVE-2025-6020-2.patch: add flags to indicate
path safety.
- debian/patches-applied/CVE-2025-6020-3.patch: secure_opendir: do not
look at the group ownership.
- debian/patches-applied/CVE-2024-22365.patch: removed, included in
patch cluster above.
- CVE-2025-6020
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Thu, 12 Jun 2025 10:45:28 -0400
python3-urllib3 (built from python-urllib3) updated from 1.26.5-1~exp1ubuntu0.2 to 1.26.5-1~exp1ubuntu0.3:
python-urllib3 (1.26.5-1~exp1ubuntu0.3) jammy-security; urgency=medium
* SECURITY UPDATE: Information disclosure through improperly disabled
redirects.
- debian/patches/CVE-2025-50181.patch: Add "retries" check and set retries
to Retry.from_int(retries, redirect=False) as well as set
raise_on_redirect in ./src/urllib3/poolmanager.py.
- CVE-2025-50181
-- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com> Mon, 23 Jun 2025 17:07:25 -0230
libpython3.10-minimal:amd64, libpython3.10-stdlib:amd64, python3.10, python3.10-minimal (built from python3.10) updated from 3.10.12-1~22.04.9 to 3.10.12-1~22.04.10:
python3.10 (3.10.12-1~22.04.10) jammy-security; urgency=medium
* SECURITY UPDATE: incorrect address list folding
- debian/patches/CVE-2025-1795-1.patch: don't encode list separators in
Lib/email/_header_value_parser.py,
Lib/test/test_email/test__header_value_parser.py.
- debian/patches/CVE-2025-1795-2.patch: fix AttributeError in the email
module in Lib/email/_header_value_parser.py,
Lib/test/test_email/test__header_value_parser.py.
- CVE-2025-1795
* SECURITY UPDATE: DoS via bytes.decode with unicode_escape
- debian/patches/CVE-2025-4516.patch: fix use-after-free in the
unicode-escape decoder with an error handler in
Include/cpython/bytesobject.h, Include/cpython/unicodeobject.h,
Lib/test/test_codeccallbacks.py, Lib/test/test_codecs.py,
Objects/bytesobject.c, Objects/unicodeobject.c,
Parser/string_parser.c.
- CVE-2025-4516
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Tue, 27 May 2025 13:12:29 -0400
python3-requests (built from requests) updated from 2.25.1+dfsg-2ubuntu0.1 to 2.25.1+dfsg-2ubuntu0.3:
requests (2.25.1+dfsg-2ubuntu0.3) jammy-security; urgency=medium
* SECURITY UPDATE: Information Leak
- debian/patches/CVE-2024-47081.patch: Only use hostname to do netrc
lookup instead of netloc
- CVE-2024-47081
-- Bruce Cable <bruce.cable@canonical.com> Wed, 11 Jun 2025 13:27:31 +1000
sudo (built from sudo) updated from 1.9.9-1ubuntu2.4 to 1.9.9-1ubuntu2.5:
sudo (1.9.9-1ubuntu2.5) jammy-security; urgency=medium
* SECURITY UPDATE: Local Privilege Escalation via host option
- debian/patches/CVE-2025-32462.patch: only allow specifying a host
when listing privileges.
- CVE-2025-32462
-- Marc Deslauriers <marc.deslauriers@ubuntu.com> Wed, 25 Jun 2025 08:48:23 -0400
12/06/2025, commit https://git.launchpad.net/snap-core22/tree/7c3b8a59559a1d01f35830501a6ef478213ae767
[ Changes in the core22 snap ]
No detected changes for the core22 snap
[ Changes in primed packages ]
libapt-pkg6.0:amd64 (built from apt) updated from 2.4.13 to 2.4.14:
apt (2.4.14) jammy; urgency=medium
* Fix buffer overflow, stack overflow, exponential complexity in
apt-ftparchive Contents generation (LP: #2083697)
- ftparchive: Mystrdup: Add safety check and bump buffer size
- ftparchive: contents: Avoid exponential complexity and overflows
- test framework: Improve valgrind support
- test: Check that apt-ftparchive handles deep paths
- increase valgrind cleanliness to make the tests pass
- pkgcachegen: Use placement new to construct header
- Workaround valgrind "invalid read" in ExtractTar::Go by moving large
buffer from stack to heap. The large buffer triggered some bugs in
valgrind stack clash protection handling.
-- Julian Andres Klode <juliank@ubuntu.com> Tue, 22 Oct 2024 15:09:58 +0200
cloud-init (built from cloud-init) updated from 24.4.1-0ubuntu0~22.04.2 to 25.1.2-0ubuntu0~22.04.2:
cloud-init (25.1.2-0ubuntu0~22.04.2) jammy; urgency=medium
* New bugfix release. (LP: #2113797)
- Revert relocation of systemd units and service files from /usr/lib
back to /lib so debhelper correctly enables cloud-init services in
postinst
-- Chad Smith <chad.smith@canonical.com> Mon, 09 Jun 2025 17:00:37 -0600
cloud-init (25.1.2-0ubuntu0~22.04.1) jammy; urgency=medium
* Upstream snapshot based on 25.1.2. (LP: #2104165).
List of changes from upstream can be found at
https://raw.githubusercontent.com/canonical/cloud-init/25.1.2/ChangeLog
-- James Falcon <james.falcon@canonical.com> Fri, 02 May 2025 12:47:51 -0500
cloud-init (25.1.1-0ubuntu1~22.04.1) jammy; urgency=medium
* Drop cpicks which are now upstream:
- d/p/cpick-d75840be-fix-retry-AWS-hotplug-for-async-IMDS-5995
- d/p/cpick-84806336-chore-Add-feature-flag-for-manual-network-waiting
- d/p/cpick-c60771d8-test-pytestify-test_url_helper.py
- d/p/cpick-8810a2dc-test-Remove-CiTestCase-from-test_url_helper.py
- d/p/cpick-582f16c1-test-add-OauthUrlHelper-tests
- d/p/cpick-9311e066-fix-Update-OauthUrlHelper-to-use-readurl-exception_cb
* refresh patches
- d/p/deprecation-version-boundary.patch
- d/p/no-single-process.patch
- d/p/retain-ec2-default-net-update-events.patch
- d/p/revert-551f560d-cloud-config-after-snap-seeding.patch
* sort hunks within all patches (--sort on quilt refresh)
* d/cloud-init.templates:
- Move VMware before OVF. See GH-4030
- Enable CloudCIX by default
* Upstream snapshot based on 25.1.1.
List of changes from upstream can be found at
https://raw.githubusercontent.com/canonical/cloud-init/25.1.1/ChangeLog
-- Chad Smith <chad.smith@canonical.com> Tue, 25 Mar 2025 10:33:28 -0600
python3-pkg-resources, python3-setuptools (built from setuptools) updated from 59.6.0-1.2ubuntu0.22.04.2 to 59.6.0-1.2ubuntu0.22.04.3:
setuptools (59.6.0-1.2ubuntu0.22.04.3) jammy-security; urgency=medium
* SECURITY UPDATE: path traversal vulnerability
- debian/patches/CVE-2025-47273-pre1.patch: Extract
_resolve_download_filename with test.
- debian/patches/CVE-2025-47273.patch: Add a check to ensure the name
resolves relative to the tmpdir.
- CVE-2025-47273
-- Fabian Toepfer <fabian.toepfer@canonical.com> Wed, 28 May 2025 19:13:58 +0200
libpam-systemd:amd64, libsystemd0:amd64, libudev1:amd64, systemd, systemd-sysv, systemd-timesyncd, udev (built from systemd) updated from 249.11-0ubuntu3.15 to 249.11-0ubuntu3.16:
systemd (249.11-0ubuntu3.16) jammy-security; urgency=medium
* SECURITY UPDATE: race condition in systemd-coredump
- debian/patches/CVE_2025_4598_1.patch: coredump: get rid of
_META_MANDATORY_MAX.
- debian/patches/CVE_2025_4598_2.patch: coredump: use %d in kernel core
pattern.
- debian/patches/CVE_2025_4598_3.patch: coredump: get rid of a bogus
assertion.
- CVE-2025-4598
-- Octavio Galland <octavio.galland@canonical.com> Wed, 04 Jun 2025 11:17:43 -0300
Mini Shell