containerd (1.6.12-0ubuntu1~22.04.11) jammy-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 SETTINGS frame infinite loop (vendored
    golang.org/x/net)
    - debian/patches/CVE-2026-33814.patch: move s.Valid() check before
      switch in ForeachSetting callback
    - CVE-2026-33814
  * SECURITY UPDATE: Uncontrolled Resource Consumption via unbounded
    group parsing
    - debian/patches/CVE-2026-47262.patch: bound user-database file
      reads in openBoundedUserFile, reject non-regular files
    - CVE-2026-47262
  * SECURITY UPDATE: Reserved label propagation from image configs
    - debian/patches/CVE-2026-53488.patch: filter containerd.io/ and
      io.cri-containerd labels from image config
    - CVE-2026-53488

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Mon, 22 Jun 2026 18:09:46 +0200

containerd (1.6.12-0ubuntu1~22.04.10) jammy-security; urgency=medium

  * SECURITY UPDATE: local priv escalation vulnerability
    - debian/patches/CVE-2024-25621.patch: Fix directory permissions
    - CVE-2024-25621
  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2025-64329.patch: fix goroutine leak of container
      attach
    - CVE-2025-64329

 -- Nishit Majithia <nishit.majithia@canonical.com>  Tue, 27 Jan 2026 19:05:49 +0530

containerd (1.6.12-0ubuntu1~22.04.9) jammy-security; urgency=medium

  * No change rebuild due to golang-1.22 update

 -- Evan Caville <evan.caville@canonical.com>  Thu, 19 Jun 2025 14:17:50 +1000

containerd (1.6.12-0ubuntu1~22.04.8) jammy-security; urgency=medium

  * SECURITY UPDATE: Integer overflow.
    - debian/patches/CVE-2024-40635.patch: Add maxUserID and maxGroupID with
      limitations in ./oci/spec_opts.go.
    - CVE-2024-40635

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 24 Mar 2025 16:17:54 -0230

containerd (1.6.12-0ubuntu1~22.04.7) jammy-security; urgency=medium

  * No change rebuild due to golang-1.21 update

 -- Nishit Majithia <nishit.majithia@canonical.com>  Wed, 10 Jul 2024 09:37:08 +0530

containerd (1.6.12-0ubuntu1~22.04.6) jammy-security; urgency=medium

  * No change rebuild due to golang-1.20, golang-1.21 updates

 -- Nishit Majithia <nishit.majithia@canonical.com>  Thu, 18 Jan 2024 10:09:08 +0530

containerd (1.6.12-0ubuntu1~22.04.5) jammy; urgency=medium

  * d/tests: remove since the containerd binary package is now provided by
    src:containerd-app.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Mon, 17 Jul 2023 16:11:59 -0300

containerd (1.6.12-0ubuntu1~22.04.4) jammy; urgency=medium

  * Do not provided the containerd binary package anymore (LP: #2022390).
    The containerd binary package is now provided by src:containerd-app.
    - d/control: remove the containerd binary package paragraph.
    - d/containerd.*: remove all files related to the containerd binary
      package.
    - d/docs: remove application documentation.
    - d/rules: remove override_dh_installsystemd.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Fri, 14 Jul 2023 16:18:35 -0300

containerd (1.6.12-0ubuntu1~22.04.3) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service through image processing
    - debian/patches/CVE-2023-25153.patch: limit the amount of
      bytes read to 20Mb in images/archive/importer.go.
    - CVE-2023-25153
  * SECURITY UPDATE: Incorrect supplementary group access control
    - debian/patches/CVE-2023-25173.patch: ensure that primary GID
      is included in the list of additionals GIDs in oci/spec_opts.go.
    - CVE-2023-25173
  * d/p/skip-test-setting-OOM-score-to-negative-number-in-unprivileged-mode.patch:
    fix a FTBFS in Ubuntu builders only.

 -- David Fernandez Gonzalez <david.fernandezgonzalez@canonical.com>  Tue, 04 Jul 2023 09:37:55 +0200

containerd (1.6.12-0ubuntu1~22.04.1) jammy; urgency=medium

  * Backport version 1.6.12-0ubuntu1 from Lunar (LP: #1996909, #1996534).

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Tue, 03 Jan 2023 17:58:41 -0300

# For older changelog entries, run 'apt-get changelog golang-github-containerd-containerd-dev'
