dotnet8 (8.0.129-8.0.29-0ubuntu1~22.04.1) jammy-security; urgency=medium

  * New upstream release
  * SECURITY UPDATE: denial of service
    - CVE-2026-57108: .NET runtime - CryptoNative_GetX509NameInfo - UPN
      BOOLEAN ASN.1 type-confusion DoS.
  * SECURITY UPDATE:
    - CVE-2026-47303: ASP.NET Core - Negotiate/LdapAdapter.cs - LDAP
      identifier confusion CN vs sAMAccountName.
  * SECURITY UPDATE: code injection
    - CVE-2026-47300: LdapAdapter query validation fix - LDAP injection via
      unvalidated filter input.
  * SECURITY UPDATE: code injection
    - CVE-2026-50659: System.Net.Mail - SMTP smuggling via CRLF split across
      buffers.
  * SECURITY UPDATE: security feature bypass
    - CVE-2026-50528: System.Net.Security - additional SslStream fix (auth
      bypass via ignored channel binding).
  * SECURITY UPDATE: denial of service
    - CVE-2026-50525: EncryptedXml/TransformChain - DoS via XML transform
      chain DTD/base64 amplification.
  * SECURITY UPDATE: security feature bypass
    - CVE-2026-47304: EncryptedXml - XML Encryption vulnerability
      (SignedXml.CheckSignature forgery via empty HMAC).
  * SECURITY UPDATE: stack overflow
    - CVE-2026-50527: EncryptedXml - System.Security.Cryptography.Xml.Utils -
      Unauth XML triggers Type.GetType stack overflow.
  * SECURITY UPDATE: denial of service
    - CVE-2026-50648: EncryptedXml - XmlDecryptionTransform document-rooted
      XPath queries causing O(n²) CPU DoS.
  * SECURITY UPDATE: denial of service
    - CVE-2026-47302: EncryptedXml - XML Encryption vulnerability +
      XmlTextReaderImpl.Read duplicate attributes DoS.
  * SECURITY UPDATE: security feature bypass
    - CVE-2026-50524: System.Net.Security - SslStream handshake with malformed
      TLS packets.
  * SECURITY UPDATE: blob injection
    - CVE-2026-50526: .NET SDK - Container image build cache uses predictable
      world-writable location enabling blob injection.
  * SECURITY UPDATE: denial of service
    - CVE-2026-50651: SocketsHttpHandler Http2Connection - HTTP/2
      SETTINGS/PING ACK flood causing OOM.
  * Fix `dotnet sdk check` command source URL. (LP: #2156464)
    - d/eng/dotnet-pkg-info.mk: strip suffixes from changelog distribution
      name to avoid using wrong release names.
    - d/t/regular-tests/dotnet-sdk-check-url-verification: test to verify the
      sdk check command queries a URL with a valid release name.
    - d/t/regular-tests/README.md: add distro-info as a necessary dependency
      for the testsuite.
    - d/t/control: add distro-info as a test dependency.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Tue, 07 Jul 2026 17:23:34 -0300

dotnet8 (8.0.128-8.0.28-0ubuntu1~22.04.1) jammy-security; urgency=medium

  [ Mateus Rodrigues de Morais ]
  * New upstream release
  * SECURITY UPDATE: arbitrary file write
    - CVE-2026-45491: improper link resolution before file access
      ('link following') in .NET allows an unauthorized attacker to perform
      local tampering.
  * SECURITY UPDATE: denial of service
    - CVE-2026-45591: Stack overflow DoS via deeply-nested MessagePack arrays.

 -- Ian Constantin <ian.constantin@canonical.com>  Wed, 10 Jun 2026 10:35:01 +0300

dotnet8 (8.0.127-8.0.27-0ubuntu1~22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service
    - CVE-2026-42899: Loop with unreachable exit condition ('infinite loop')
      in ASP.NET Core allows an unauthorized attacker to deny service over a
      network.

  [ Mateus Rodrigues de Morais ]
  * New upstream release (LP: #2152591)
  * d/t/regular-tests/check-test-results: match to any NU1102 error
    occurrences when ignoring package not found restore errors.
  * d/t/regular-tests/template-test/test.json: increment timeout multiplier to
    avoid timeout errors when running on the autopkgtest cloud.
  * d/t/regular-tests/tools-in-path/test.json: skip test when running on the
    toolchains-ci CI pipeline.
  * d/t/run-regular-tests: define environment variable to selectively add the
    'toolchains-ci' trait to the test runner.

 -- Ian Constantin <ian.constantin@canonical.com>  Fri, 22 May 2026 17:45:46 +0300

dotnet8 (8.0.126-8.0.26-0ubuntu1~22.04.1) jammy-security; urgency=medium

  [ Mateus Rodrigues de Morais ]
  * New upstream release
  * SECURITY UPDATE: denial of service
    - CVE-2026-33116: Possible denial of service via infinite recursion in
      XmlDecryptionTransform.
  * SECURITY UPDATE: denial of service
    - CVE-2026-32203: Possible denial of service via stack overflow in
      EncryptedKey nested decryption.
  * SECURITY UPDATE: remote code execution
    - CVE-2026-32178: SMTP command injection and header injection via
      MailAddress parsing flaw in System.Net.Mail.
  * SECURITY UPDATE: security feature bypass
    - CVE-2026-26171: denial of service and security feature bypass via unsafe
      transforms in EncryptedXml.

 -- Ian Constantin <ian.constantin@canonical.com>  Tue, 14 Apr 2026 19:43:50 +0000

dotnet8 (8.0.125-8.0.25-0ubuntu1~22.04.1) jammy-security; urgency=medium

  [ Mateus Rodrigues de Morais ]
  * New upstream release
  * SECURITY UPDATE: denial of service
    - CVE-2026-26130: Possible denial-of-service via SignalR stateful
      reconnect buffer overfill.

 -- Ian Constantin <ian.constantin@canonical.com>  Sun, 08 Mar 2026 21:24:10 +0200

dotnet8 (8.0.124-8.0.24-0ubuntu1~22.04.1) jammy; urgency=medium

  * New upstream release
  * SECURITY UPDATE: security feature bypass
    - CVE-2026-21218: An attacker could exploit this vulnerability in
      System.Security.Cryptography.Cose by crafting a malicious payload that
      bypasses the security checks in the affected .NET versions, potentially
      leading to unauthorized access or data manipulation.
  * d/p/0002-roslyn-analyzers-dont-use-apphost.patch: refreshed patch to fix
    hunk failure.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Mon, 02 Feb 2026 17:30:30 -0300

dotnet8 (8.0.123-8.0.23-0ubuntu1~22.04.1) jammy; urgency=medium

  * New upstream release (LP: #2138326)
  * d/t/regular-tests: synced with upstream.
    - Removed release-version-sane test following upstream.
    - Removed unnecessary files from source tree.
    - cgroup-limit/test.sh: fix autopkgtest regression in Ubuntu releases with
      rust-coreutils by comparing the cgroup filesystem ID instead of friendly
      name.
  * d/t/run-regular-tests: fixed test username typo.
  * d/rules: cleaned up trailing spaces.
  * d/eng/test-runner: removed unnecessary files from source tree.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Tue, 20 Jan 2026 11:23:58 -0300

dotnet8 (8.0.122-8.0.22-0ubuntu1~22.04.1) jammy; urgency=medium

  * New upstream release (LP: #2130895)
  * d/{sdk-check-config.json,rules}: `dotnet sdk check` tool points to
    Canonical's release database.
  * d/eng/test-runner/*/obj: removed unwanted build artifact directory from
    source package.
  * d/t/regular-tests: synced with upstream to fix failing tests and add new
    ones for .NET 10.

 -- Mateus Rodrigues de Morais <mateus.morais@canonical.com>  Fri, 07 Nov 2025 17:02:25 +0100

dotnet8 (8.0.121-8.0.21-0ubuntu1~22.04.1) jammy; urgency=medium

  * New upstream release
  * SECURITY UPDATE: denial of service
    - CVE-2025-55247: A vulnerability exists in .NET Core where predictable
      paths for MSBuild's temporary directories on Linux let another user
      create the directories ahead of MSBuild, leading to DoS of builds.
  * SECURITY UPDATE: validation bypass
    - CVE-2025-55315: Inconsistent interpretation of http requests
      ('http request/response smuggling') in ASP.NET Core allows an authorized
      attacker to bypass a security feature over a network.
  * SECURITY UPDATE: information disclosure
    - CVE-2025-55248: MITM (man in the middle) attacker may prevent use of TLS
      between client and SMTP server, forcing client to send data over
      unencrypted connection.
  * eng/test-runner: sync changes with upstream
  * tests/control, tests/regular-tests: sync changes with upstream
  * debian/rules: use release.json manifest instead of legacy text file

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Wed, 08 Oct 2025 13:49:14 +0300

dotnet8 (8.0.120-8.0.20-0ubuntu1~22.04.1) jammy; urgency=medium

  * New upstream release (LP: #2122356)

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Mon, 08 Sep 2025 20:48:08 +0300

# For older changelog entries, run 'apt-get changelog dotnet-apphost-pack-8.0'
