frr (8.1-1ubuntu1.16) jammy-security; urgency=medium

  * SECURITY UPDATE: integer overflow in OSPF parsing
    - debian/patches/CVE-2026-28532.patch: ospfd: harden TE/SR TLV iteration
      against malformed lengths in ospfd/ospf_sr.c, ospfd/ospf_te.c.
    - CVE-2026-28532
  * SECURITY UPDATE: DoS via crafted FlowSpec component
    - debian/patches/CVE-2026-37457.patch: bgpd: fix off-by-one error in
      FlowSpec operator array bounds check in bgpd/bgp_flowspec_util.c.
    - CVE-2026-37457
  * SECURITY UPDATE: DoS via crafted UPDATE message
    - debian/patches/CVE-2026-37458.patch: bgpd: Validate MP_REACH_NLRI
      attribute against incorrect next-hop in bgpd/bgp_attr.c.
    - CVE-2026-37458

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sat, 30 May 2026 11:44:32 -0400

frr (8.1-1ubuntu1.15) jammy-security; urgency=medium

  * SECURITY UPDATE: Improper Access Controls
    - debian/patches/CVE-2026-5107.patch: Improve packet parsing for
      EVPN and ENCAP/VNC
    - CVE-2026-5107

 -- Bruce Cable <bruce.cable@canonical.com>  Fri, 10 Apr 2026 12:42:06 +1000

frr (8.1-1ubuntu1.14) jammy-security; urgency=medium

  * SECURITY UPDATE: multiple ospf security issues
    - debian/patches/CVE-2025-61xxx-1.patch: add null check for vty_out in
      check_tlv_size in ospfd/ospf_ext.c.
    - debian/patches/CVE-2025-61xxx-2.patch: fix NULL Pointer Deference
      when dumping link info in ospfd/ospf_ext.c.
    - debian/patches/CVE-2025-61xxx-3.patch: skip subsequent tlvs after
      invalid length in ospfd/ospf_ext.c, ospfd/ospf_ri.c, ospfd/ospf_te.c.
    - debian/patches/CVE-2025-61xxx-4.patch: reformat check_tlv_size macro
      in ospfd/ospf_ext.c, ospfd/ospf_ri.c, ospfd/ospf_te.c.
    - CVE-2025-61099, CVE-2025-61100, CVE-2025-61101, CVE-2025-61102,
      CVE-2025-61103, CVE-2025-61104, CVE-2025-61105, CVE-2025-61106,
      CVE-2025-61107

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 12 Feb 2026 10:05:19 -0500

frr (8.1-1ubuntu1.13) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service via route re-validation
    - debian/patches/CVE-2024-55553.patch: bgpd: Validate only affected
      RPKI prefixes instead of a full RIB
    - Ubuntu note: Adjusted from backport of 7.5 to fit 8.1.
    - Attempt to correct failing test for ppc64
    - CVE-2024-55553

 -- John Breton <john.breton@canonical.com>  Fri, 24 Jan 2025 14:38:53 -0500

frr (8.1-1ubuntu1.12) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service via route re-validation
    - debian/patches/CVE-2024-55553.patch: bgpd: Validate only affected
      RPKI prefixes instead of a full RIB
    - Ubuntu note: Adjusted from backport of 7.5 to fit 8.1.
    - CVE-2024-55553

 -- John Breton <john.breton@canonical.com>  Fri, 24 Jan 2025 14:09:39 -0500

frr (8.1-1ubuntu1.11) jammy-security; urgency=medium

  * SECURITY UPDATE: BGP overflow via TLV value
    - debian/patches/CVE-2024-44070.patch: check the actual remaining
      stream length before taking TLV value in bgpd/bgp_attr.c.
    - CVE-2024-44070

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 10 Sep 2024 07:39:38 -0400

frr (8.1-1ubuntu1.10) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS via malformed Prefix SID attribute
    - debian/patches/CVE-2024-31948-1.patch: fix error handling when
      receiving BGP Prefix SID attribute in bgpd/bgp_attr.c.
    - debian/patches/CVE-2024-31948-2.patch: prevent from one more CVE
      triggering this place in bgpd/bgp_attr.c.
    - CVE-2024-31948
  * SECURITY UPDATE: DoS via malformed OSPF LSA packets
    - debian/patches/CVE-2024-31950.patch: solved crash in RI parsing with
      OSPF TE in ospfd/ospf_te.c.
    - CVE-2024-31950
  * SECURITY UPDATE: DoS via malformed OSPF LSA packets
    - debian/patches/CVE-2024-31951.patch: correct Opaque LSA Extended
      parser in ospfd/ospf_te.c.
    - CVE-2024-31951
  * SECURITY UPDATE: DoS via invalid edge data
    - debian/patches/CVE-2024-34088.patch: protect call to get_edge() in
      ospf_te.c.
    - CVE-2024-34088

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 27 May 2024 13:18:20 -0400

frr (8.1-1ubuntu1.9) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS via malformed OSPF LSA packet
    - debian/patches/CVE-2024-27913.patch: solved crash in OSPF TE parsing
      in ospfd/ospf_te.c.
    - CVE-2024-27913

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 05 Mar 2024 08:27:58 -0500

frr (8.1-1ubuntu1.8) jammy-security; urgency=medium

  * SECURITY UPDATE: flowspec overflow issue
    - debian/patches/CVE-2023-38406.patch: check length in
      bgpd/bgp_flowspec.c.
    - CVE-2023-38406
  * SECURITY UPDATE: read beyond stream during labeled unicast parsing
    - debian/patches/CVE-2023-38407.patch: fix use beyond end of stream of
      labeled unicast parsing in bgpd/bgp_label.c.
    - CVE-2023-38407
  * SECURITY UPDATE: crash via MP_UNREACH_NLRI attribute
    - debian/patches/CVE-2023-47234.patch: ignore handling NLRIs if we
      received MP_UNREACH_NLRI in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-47234
  * SECURITY UPDATE: crash via malformed BGP UPDATE message
    - debian/patches/CVE-2023-47235.patch: treat EOR as withdrawn to avoid
      unwanted handling of malformed attrs in bgpd/bgp_attr.c.
    - CVE-2023-47235

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 16 Nov 2023 09:48:20 -0500

frr (8.1-1ubuntu1.7) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS via MP_REACH_NLRI data
    - debian/patches/CVE-2023-46752.patch: handle MP_REACH_NLRI malformed
      packets with session reset in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-46752
  * SECURITY UPDATE: DoS via BGP UPDATE without mandatory attributes
    - debian/patches/CVE-2023-46753.patch: check mandatory attributes more
      carefully for UPDATE message in bgpd/bgp_attr.c.
    - CVE-2023-46753

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 01 Nov 2023 14:30:38 -0400

# For older changelog entries, run 'apt-get changelog frr-doc'
