frr (8.4.4-1.1ubuntu6.7) noble-security; urgency=medium

  * SECURITY UPDATE: integer overflow in OSPF parsing
    - debian/patches/CVE-2026-28532.patch: ospfd: harden TE/SR TLV iteration
      against malformed lengths in ospfd/ospf_sr.c, ospfd/ospf_te.c.
    - CVE-2026-28532
  * SECURITY UPDATE: DoS via crafted FlowSpec component
    - debian/patches/CVE-2026-37457.patch: bgpd: fix off-by-one error in
      FlowSpec operator array bounds check in bgpd/bgp_flowspec_util.c.
    - CVE-2026-37457
  * SECURITY UPDATE: DoS via crafted UPDATE message
    - debian/patches/CVE-2026-37458.patch: bgpd: Validate MP_REACH_NLRI
      attribute against incorrect next-hop in bgpd/bgp_attr.c.
    - CVE-2026-37458

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sat, 30 May 2026 11:43:02 -0400

frr (8.4.4-1.1ubuntu6.6) noble-security; urgency=medium

  * SECURITY UPDATE: Improper Access Controls
    - debian/patches/CVE-2026-5107.patch: Improve packet parsing for
      EVPN and ENCAP/VNC
    - CVE-2026-5107

 -- Bruce Cable <bruce.cable@canonical.com>  Fri, 10 Apr 2026 12:42:03 +1000

frr (8.4.4-1.1ubuntu6.5) noble-security; urgency=medium

  * SECURITY UPDATE: multiple ospf security issues
    - debian/patches/CVE-2025-61xxx-1.patch: add null check for vty_out in
      check_tlv_size in ospfd/ospf_ext.c.
    - debian/patches/CVE-2025-61xxx-2.patch: fix NULL Pointer Deference
      when dumping link info in ospfd/ospf_ext.c.
    - debian/patches/CVE-2025-61xxx-3.patch: skip subsequent tlvs after
      invalid length in ospfd/ospf_ext.c, ospfd/ospf_ri.c, ospfd/ospf_te.c.
    - debian/patches/CVE-2025-61xxx-4.patch: reformat check_tlv_size macro
      in ospfd/ospf_ext.c, ospfd/ospf_ri.c, ospfd/ospf_te.c.
    - CVE-2025-61099, CVE-2025-61100, CVE-2025-61101, CVE-2025-61102,
      CVE-2025-61103, CVE-2025-61104, CVE-2025-61105, CVE-2025-61106,
      CVE-2025-61107

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 12 Feb 2026 09:42:08 -0500

frr (8.4.4-1.1ubuntu6.4) noble; urgency=medium

  * d/p/lp2113448-evpn-vxlan-macs: fix forgeting learned MACs on redundant
    EVPN over VXLAN links (LP: #2113448)

 -- Jonas Jelten <jonas.jelten@canonical.com>  Mon, 20 Oct 2025 11:12:35 +0200

frr (8.4.4-1.1ubuntu6.3) noble-security; urgency=medium

  * SECURITY UPDATE: Denial of service via route re-validation
    - debian/patches/CVE-2024-55553.patch: bgpd: Validate only affected
      RPKI prefixes instead of a full RIB.
    - Ubuntu note: Adjusted from backport of 7.5 to fit 8.4.4.
    - CVE-2024-55553

 -- John Breton <john.breton@canonical.com>  Fri, 24 Jan 2025 09:43:49 -0500

frr (8.4.4-1.1ubuntu6.2) noble-security; urgency=medium

  * SECURITY UPDATE: BGP overflow via TLV value
    - debian/patches/CVE-2024-44070.patch: check the actual remaining
      stream length before taking TLV value in bgpd/bgp_attr.c.
    - CVE-2024-44070

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 10 Sep 2024 07:38:37 -0400

frr (8.4.4-1.1ubuntu6.1) noble-security; urgency=medium

  * SECURITY UPDATE: DoS via malformed Prefix SID attribute
    - debian/patches/CVE-2024-31948-1.patch: fix error handling when
      receiving BGP Prefix SID attribute in bgpd/bgp_attr.c.
    - debian/patches/CVE-2024-31948-2.patch: prevent from one more CVE
      triggering this place in bgpd/bgp_attr.c.
    - CVE-2024-31948
  * SECURITY UPDATE: DoS via malformed OSPF LSA packets
    - debian/patches/CVE-2024-31950.patch: solved crash in RI parsing with
      OSPF TE in ospfd/ospf_te.c.
    - CVE-2024-31950
  * SECURITY UPDATE: DoS via malformed OSPF LSA packets
    - debian/patches/CVE-2024-31951.patch: correct Opaque LSA Extended
      parser in ospfd/ospf_te.c.
    - CVE-2024-31951
  * SECURITY UPDATE: DoS via invalid edge data
    - debian/patches/CVE-2024-34088.patch: protect call to get_edge() in
      ospf_te.c.
    - CVE-2024-34088

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 27 May 2024 13:09:15 -0400

frr (8.4.4-1.1ubuntu6) noble; urgency=medium

  * No-change rebuild for c-ares t64.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 16 Apr 2024 11:56:13 +0200

frr (8.4.4-1.1ubuntu5) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 05:25:32 +0000

frr (8.4.4-1.1ubuntu4) noble; urgency=medium

  * SECURITY UPDATE: DoS via malformed OSPF LSA packet
    - debian/patches/CVE-2024-27913.patch: solved crash in OSPF TE parsing
      in ospfd/ospf_te.c.
    - CVE-2024-27913

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 05 Mar 2024 08:25:28 -0500

frr (8.4.4-1.1ubuntu3) noble; urgency=medium

  * SECURITY UPDATE: read beyond stream during labeled unicast parsing
    - debian/patches/CVE-2023-38407.patch: fix use beyond end of stream of
      labeled unicast parsing in bgpd/bgp_label.c.
    - CVE-2023-38407
  * SECURITY UPDATE: crash via MP_UNREACH_NLRI attribute
    - debian/patches/CVE-2023-47234.patch: ignore handling NLRIs if we
      received MP_UNREACH_NLRI in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-47234
  * SECURITY UPDATE: crash via malformed BGP UPDATE message
    - debian/patches/CVE-2023-47235.patch: treat EOR as withdrawn to avoid
      unwanted handling of malformed attrs in bgpd/bgp_attr.c.
    - CVE-2023-47235

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 16 Nov 2023 09:19:43 -0500

frr (8.4.4-1.1ubuntu2) noble; urgency=medium

  * SECURITY UPDATE: DoS via MP_REACH_NLRI data
    - debian/patches/CVE-2023-46752.patch: handle MP_REACH_NLRI malformed
      packets with session reset in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-46752
  * SECURITY UPDATE: DoS via BGP UPDATE without mandatory attributes
    - debian/patches/CVE-2023-46753.patch: check mandatory attributes more
      carefully for UPDATE message in bgpd/bgp_attr.c.
    - CVE-2023-46753

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 01 Nov 2023 14:12:59 -0400

frr (8.4.4-1.1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2033921). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 01 Sep 2023 15:15:39 -0300

frr (8.4.4-1.1) unstable; urgency=high

  * Non-maintainer upload by the Security Team.
  * Upstream fixes for CVE-2023-38802, CVE-2023-41358, CVE-2023-41360

 -- Aron Xu <aron@debian.org>  Fri, 01 Sep 2023 16:57:41 +0800

frr (8.4.4-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2018072). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership
  * Dropped:
    - SECURITY UPDATE: denial of service via bgp_capability_llgr()
      + debian/patches/CVE-2023-31489.patch: check 7 bytes for Long-lived
        Graceful-Restart capability in bgpd/bgp_open.c.
      + CVE-2023-31489
        [Fixed upstream in 8.4.4]
    - SECURITY UPDATE: denial of service via bgp_attr_psid_sub()
      + debian/patches/CVE-2023-31490.patch: ensure stream received has
        enough data in bgpd/bgp_attr.c.
      + CVE-2023-31490
        [Fixed upstream in version 8.4.4]

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 26 Jul 2023 17:43:05 -0300

frr (8.4.4-1) unstable; urgency=medium

  * new upstream release FRR 8.4.4
  * upstream fix CVE-2023-31489 (closes: #1036061)
  * upstream fix CVE-2023-31490 (closes: #1036062)
  * correctly use sphinxdoc:Built-Using
  * point watch file at git tarball, no more upstream dist tarballs

 -- David Lamparter <equinox-debian@diac24.net>  Wed, 12 Jul 2023 14:28:34 +0200

frr (8.4.2-1ubuntu2) mantic; urgency=medium

  * SECURITY UPDATE: denial of service via bgp_capability_llgr()
    - debian/patches/CVE-2023-31489.patch: check 7 bytes for Long-lived
      Graceful-Restart capability in bgpd/bgp_open.c.
    - CVE-2023-31489
  * SECURITY UPDATE: denial of service via bgp_attr_psid_sub()
    - debian/patches/CVE-2023-31490.patch: ensure stream received has
      enough data in bgpd/bgp_attr.c.
    - CVE-2023-31490

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 02 Jun 2023 13:14:57 -0400

frr (8.4.2-1ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership

 -- Andreas Hasenack <andreas@canonical.com>  Sun, 29 Jan 2023 15:28:40 -0300

frr (8.4.2-1) unstable; urgency=medium

  * new upstream release FRR 8.4.2
  * drop all patches in debian/patches/, they got merged upstream

 -- David Lamparter <equinox-debian@diac24.net>  Mon, 23 Jan 2023 17:32:02 +0100

frr (8.4.1-2ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable (LP: #1993401). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership
  * Dropped (fixed upstream):
    - SECURITY UPDATE: overflow via input packet length
      + debian/patches/CVE-2022-26125.patch: fix router capability TLV
        parsing issues in isisd/isis_tlvs.*.
      + debian/patches/disable_isisd_fuzz_test.patch: disable fuzz tests as
        the security update changed expected results in
        tests/isisd/test_fuzz_isis_tlv.py.
      + CVE-2022-26125
    - SECURITY UPDATE: overflow via use of strdup with binary string
      + debian/patches/CVE-2022-26126.patch: use base64 encoding in
        isisd/isis_nb_notifications.c, lib/base64.c, lib/base64.h,
        lib/subdir.am, lib/yang_wrappers.c, lib/yang_wrappers.h.
      + CVE-2022-26126
    - SECURITY UPDATE: overflow via missing check on the input packet length
      + debian/patches/CVE-2022-26127.patch: add check on packet length in
        babeld/message.c.
      + CVE-2022-2612
    - SECURITY UPDATE: overflow via wrong checks
      + debian/patches/CVE-2022-26128_9.patch: fix checks on length in
        babeld/message.c.
      + CVE-2022-26128
      + CVE-2022-26129
    - SECURITY UPDATE: DoS via out-of-bounds read
      + debian/patches/CVE-2022-37032.patch: make sure hdr length is at a
        minimum of what is expected in bgpd/bgp_packet.c.
      + CVE-2022-37032
    - SECURITY UPDATE: use-after-free due to a race condition
      + debian/patches/CVE-2022-37035.patch: avoid notify race between io and
        main pthreads in bgpd/bgp_io.c, bgpd/bgp_packet.c, bgpd/bgp_packet.h.
      + CVE-2022-37035

 -- Andreas Hasenack <andreas@canonical.com>  Sun, 08 Jan 2023 17:57:05 -0300

frr (8.4.1-2) unstable; urgency=medium

  * commit to git tarball as source instead of dist tarball
  * ditch unneeded sphinx missing files patch
  * fix clippy symbol lookup issue (build SEGV on mips64el)
  * correctly mark :native for libelf-dev & libpython3-dev to fix cross-build
  * use mutex for zserv stats (atomic uint64_t is too wide for 32-bit archs)

 -- David Lamparter <equinox-debian@diac24.net>  Fri, 06 Jan 2023 14:59:57 +0100

frr (8.4.1-1) unstable; urgency=medium

  * New upstream release FRR 8.4.1 (closes: #1017518)
  * New frr@ systemd service unit to run inside network namespace
  * egrep to grep -E
  * upstream fix ospfd crash (PR 8876) (closes: #981139)
  * upstream fix isisd parsing issues CVE-2022-26125, CVE-2022-26126 and
    babeld parsing issues CVE-2022-26127, CVE-2022-26128, CVE-2022-26129
    (closes: #1008010)
  * upstream fix bgpd out-of-bounds read CVE-2022-37032 (closes: #1021016)
  * upstream fix bgpd UAF CVE-2022-37035 (closes: #1016978)
  * libyang-related pcre3 dep replaced with pcre2 (closes: #1000032)
  * disable ELF magic on mips64el
  * fixed texinfo figure installation directory
  * enable dh_sphinxdoc to get rid of embedded javascript in frr-doc
  * removed bogus iproute dependency choice

 -- David Lamparter <equinox-debian@diac24.net>  Mon, 02 Jan 2023 14:46:06 +0100

frr (8.1-1ubuntu4) lunar; urgency=medium

  * d/frr.postinst: don't change log ownership if the syslog user
    doesn't exist. Thanks to Alessandro Ratti
    <alessandro.ratti@exoscale.ch> for the fix (LP: #1991812).

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 28 Oct 2022 11:35:27 -0300

frr (8.1-1ubuntu3) kinetic; urgency=medium

  * SECURITY UPDATE: DoS via out-of-bounds read
    - debian/patches/CVE-2022-37032.patch: make sure hdr length is at a
      minimum of what is expected in bgpd/bgp_packet.c.
    - CVE-2022-37032
  * SECURITY UPDATE: use-after-free due to a race condition
    - debian/patches/CVE-2022-37035.patch: avoid notify race between io and
      main pthreads in bgpd/bgp_io.c, bgpd/bgp_packet.c, bgpd/bgp_packet.h.
    - CVE-2022-37035

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 05 Oct 2022 12:31:38 -0400

frr (8.1-1ubuntu2) kinetic; urgency=medium

  * Fix logging with Ubuntu's unprivileged rsyslog (LP: #1958162):
    - d/frr.postinst: change log files ownership
    - d/frr.logrotate: change rotated log file ownership

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 09 Jun 2022 12:35:58 -0300

frr (8.1-1ubuntu1) jammy; urgency=medium

  * SECURITY UPDATE: overflow via input packet length
    - debian/patches/CVE-2022-26125.patch: fix router capability TLV
      parsing issues in isisd/isis_tlvs.*.
    - debian/patches/disable_isisd_fuzz_test.patch: disable fuzz tests as
      the security update changed expected results in
      tests/isisd/test_fuzz_isis_tlv.py.
    - CVE-2022-26125
  * SECURITY UPDATE: overflow via use of strdup with binary string
    - debian/patches/CVE-2022-26126.patch: use base64 encoding in
      isisd/isis_nb_notifications.c, lib/base64.c, lib/base64.h,
      lib/subdir.am, lib/yang_wrappers.c, lib/yang_wrappers.h.
    - CVE-2022-26126
  * SECURITY UPDATE: overflow via missing check on the input packet length
    - debian/patches/CVE-2022-26127.patch: add check on packet length in
      babeld/message.c.
    - CVE-2022-26127
  * SECURITY UPDATE: overflow via wrong checks
    - debian/patches/CVE-2022-26128_9.patch: fix checks on length in
      babeld/message.c.
    - CVE-2022-26128
    - CVE-2022-26129

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 11 Mar 2022 07:33:41 -0500

frr (8.1-1) unstable; urgency=medium

  * New upstream release FRR 8.1
  * Upload to unstable.

 -- Ondřej Surý <ondrej@debian.org>  Sat, 13 Nov 2021 13:32:48 +0100

frr (7.5.1-1) unstable; urgency=medium

  * Update the d/gbp.conf for 7.5.1 release
  * Use wrap-and-sort -a to unify debian/ wrapping and sorting
  * Work around the sphinx-build error that doesn't copy images to texinfo
  * Change the upstream-tag in d/gbp.conf to track the upstream tarballs

 -- Ondřej Surý <ondrej@debian.org>  Mon, 08 Mar 2021 09:40:19 +0100

frr (7.5-1) unstable; urgency=medium

  * New upstream version 7.5

 -- Ondřej Surý <ondrej@debian.org>  Sun, 14 Feb 2021 21:38:50 +0100

frr (7.4-2) unstable; urgency=medium

  * Bump libyang dependency to >= 1.0.184-1~
  * Make the autopkgtest more resilient (Closes: #980111)
  * Adjust the ax_python.m4 to hardcode python3.9

 -- Ondřej Surý <ondrej@debian.org>  Sun, 07 Feb 2021 13:15:07 +0100

frr (7.4-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Backport upstream fix for FTBFS with Python 3.9. (Closes: #972767)

 -- Adrian Bunk <bunk@debian.org>  Thu, 21 Jan 2021 16:06:12 +0200

frr (7.4-1) unstable; urgency=medium

  [ Ondřej Surý ]
  * Use dh_installinit capabilities to install frr.tmpfile
  * Remove unused debian/watchfrr.rc file
  * Add missing lsof dependency
  * Remove mention of pkg.frr.snmp build profile from debian/README.Debian
  * Make lsb-base a hard dependency
  * Update gbp.conf for 7.4 release
  * Update and simplify d/watch
  * Change the debian source format from 3.0 (git) to 3.0 (quilt)
  * Convert the package to dh compat level 10
  * Add myself to Uploaders
  * Bump standards version to 4.5.0.2 (latest) - no change
  * Use wrap-and-sort -a to unify debian/ wrapping and sorting
  * Work around the sphinx-build error that doesn't copy images to texinfo
    (Properly closes: #955067)
  * Depend on debhelper >= 9.20160709 and drop dh-systemd dependency
    (Closes: #958626)

 -- Ondřej Surý <ondrej@debian.org>  Mon, 10 Aug 2020 11:50:45 +0200

frr (7.3.1-1) unstable; urgency=medium

  [ David Lamparter ]
  * allow cross-compile with sbuild --host

  [ Ondřej Surý ]
  * Add myself to Uploaders
  * Add d/gbp.conf
  * Update changelog for 7.3.1-1~1.gbp2292a4 release
  * Change the source format from git to quilt to use git-buildpackage
  * Don't install frr-doc texinfo images, they are gone (Closes: #955067)
  * Bump the dh_compat to 10

 -- Ondřej Surý <ondrej@debian.org>  Mon, 01 Jun 2020 08:41:03 +0200

frr (7.3-1) unstable; urgency=medium

  * new upstream release

 -- David Lamparter <equinox-debian@diac24.net>  Tue, 25 Feb 2020 17:45:16 +0100

frr (7.2.1-1) unstable; urgency=medium

  * new upstream release
  * daemon man pages renamed to frr-* (closes: #944392)
  * fix/improve multi-arch markers on doc
  * fix git URLs to point to debian branch

 -- David Lamparter <equinox-debian@diac24.net>  Mon, 20 Jan 2020 17:06:21 +0100

frr (7.2-1) unstable; urgency=medium

  * New upstream release

 -- Jafar Al-Gharaibeh <jafar@atcorp.com>  Sun, 03 Nov 2019 18:45:23 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog frr-doc`.
