Package "dotnet6"

  dotnet6 (6.0.123-0ubuntu1~22.04.1) jammy-security; urgency=medium

  * New upstream release.
  * SECURITY UPDATE: denial of service
    - CVE-2023-44487: Denial of service - Kestrel server.

 -- Ian Constantin <email address hidden> Wed, 04 Oct 2023 23:02:16 +0300

  dotnet6 (6.0.122-0ubuntu1~22.04.1) jammy-security; urgency=medium

  * New upstream release.
  * SECURITY UPDATE: denial of service
    - CVE-2023-36799: A vulnerability exists in .NET when processing X.509
      certificates that may result in Denial of Service.
  * debian/tests/cli-metadata-should-be-correct: updated regex for the Host
    Runtime Version check.

 -- Nishit Majithia <email address hidden> Tue, 05 Sep 2023 09:31:21 +0530

  dotnet6 (6.0.121-0ubuntu1~22.04.1) jammy-security; urgency=medium

  * New upstream release.
  * SECURITY UPDATE: remote code exection
    - CVE-2023-35390: When running some dotnet commands(e.g. dotnet help
      add), dotnet attempts to locate and initiate a new process using
      cmd.exe. However, it prioritizes searching for cmd.exe in the current
      working directory (CWD) before checking other locations. This can
      potentially lead to the execution of malicious code.
  * SECURITY UPDATE: denial of service
    - CVE-2023-38178: ASP.NET Kestrel stream flow control issue causing a
      leak. A malicious QUIC client, that fires off many unidirectional
      streams with closed writing sides. This will bypass the HTTP/3 stream
      limit and Kestrel cannot keep up with stream processing.
  * SECURITY UPDATE: denial of service
    - CVE-2023-38180: Kestrel vulnerability to slow read attacks

  [ Dominik Viererbe ]
  * d/README.source: updated content
    * added support documentation
    * added end of life process documentation
    * general overhaul
  * d/dotnet.sh.in: DOTNET_ROOT was unnecessarily set (LP: #2027620)
  * d/t/essential-binaries-and-config-files-should-be-present:
    remove check if DOTNET_ROOT is set
  * d/watch
    * updated matching-pattern to only match 6.0.1XX releases
    * d/watch file will fail now deliberately. See comment in d/watch
      for more information
  * unify d/repack-dotnet-tarball.sh into d/build-dotnet-tarball.sh and
    updated command line interface

 -- Nishit Majithia <email address hidden> Wed, 02 Aug 2023 10:42:58 +0530

  dotnet6 (6.0.120-0ubuntu1~22.04.1) jammy-security; urgency=medium

  * New upstream release.
  * SECURITY UPDATE: security feature bypass
    - CVE-2023-33170: Race Condition in ASP.NET Core SignInManager<TUser>
      PasswordSignInAsync Method
  * debian/tests/control: enabled test dotnet-runtime-json-contains-ubuntu-rids
  * debian/tests/.tests.rc.d/init.sh: fixed parsing error of runtime revision number

 -- Nishit Majithia <email address hidden> Wed, 05 Jul 2023 08:42:18 +0530

  dotnet6 (6.0.119-0ubuntu1~22.04.1) jammy-security; urgency=medium

  [ Dominik Viererbe ]
  * New upstream release.
    - Fixes regression that was introduced with the bugfix for CVE-2023-29331:
      Loading null-password-encrypted PFX certificates through .NET can fail
      unexpectedly for certificates that previously loaded successfully.

 -- Nishit Majithia <email address hidden> Thu, 22 Jun 2023 14:05:30 +0530