containerd (1.2.6-0ubuntu1~16.04.6+esm5) xenial-security; urgency=medium

  * SECURITY UPDATE: Integer overflow.
    - debian/patches/CVE-2024-40635.patch: Add maxUserID and maxGroupID with
      limitations in ./oci/spec_opts.go.
    - CVE-2024-40635

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 24 Mar 2025 17:18:23 -0230

containerd (1.2.6-0ubuntu1~16.04.6+esm4) xenial-security; urgency=medium

  * SECURITY UPDATE: Denial of service through image processing
    - debian/patches/CVE-2023-25153.patch: limit the amount of
      bytes read to 20Mb in images/archive/importer.go.
    - CVE-2023-25153
  * SECURITY UPDATE: Incorrect supplementary group access control
    - debian/patches/CVE-2023-25173-pre.patch: use readonly mount
      to read user/group info in oci/spec_opts.go.
    - debian/patches/CVE-2023-25173.patch: ensure that primary GID
      is included in the list of additionals GIDs in oci/spec_opts.go.
    - CVE-2023-25173
  * d/p/skip-test-setting-OOM-score-to-negative-number-in-unprivileged-mode.patch:
    fix a FTBFS in Ubuntu builders only.

 -- David Fernandez Gonzalez <david.fernandezgonzalez@canonical.com>  Mon, 03 Jul 2023 13:38:19 +0200

containerd (1.2.6-0ubuntu1~16.04.6+esm2) xenial-security; urgency=medium

  * SECURITY UPDATE: Path Traversal
    - debian/patches/CVE-2021-32760.patch: Use chmod path for checking symlink.
    - debian/patches/CVE-2021-41103_1.patch: v2 runtime: reduce permissions
      for bundle dir.
    - debian/patches/CVE-2021-41103_2.patch: v1 runtime: reduce permissions
      for bundle dir.
    - debian/patches/CVE-2021-41103_3.patch: btrfs: reduce permissions
      on plugin directories.
    - CVE-2021-32760
    - CVE-2021-41103
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2022-31030.patch: Merge pull request from
      GHSA-5ffw-gxpp-mxpf.
    - CVE-2022-31030

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Wed, 13 Jul 2022 13:19:57 +0000

containerd (1.2.6-0ubuntu1~16.04.6+esm1) xenial-security; urgency=medium

  * SECURITY UPDATE: Insecure handling of image volumes
    - debian/patches/CVE-2022-23648.patch: Use fs.RootPath when mounting
    volumes.
    - debian/patches/update_cri_to_release_1_4.patch: Update CRI to 1.4.
    - CVE-2022-23648

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Thu, 24 Feb 2022 17:34:56 +0000

containerd (1.2.6-0ubuntu1~16.04.6) xenial; urgency=medium

  * d/control: add a Breaks for docker.io lower than 18.09.7-0ubuntu1~16.04.7
    (LP: #1870514). The previous versions stop the docker daemon when a
    containerd update is performed, this Breaks statement will make sure we
    have a newer version which has the appropriate fix.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Fri, 11 Dec 2020 09:19:07 -0300

containerd (1.2.6-0ubuntu1~16.04.5) xenial-security; urgency=medium

  * SECURITY UPDATE: Elevation of privilege vulnerability
    - debian/patches/Add-runc.v2-multi-shim_partial2.patch: Add runc.v2
      multi-shim (partially).
    - debian/patches/horten-the-unix-socket-path-for-shim.patch: horten the
      unix socket path for shim.
    - debian/patches/Include-extension-for-shim-binary-format-on-Windows.patch:
      Include extension for shim binary format.
    - debian/patches/CVE-2020-15257.patch: Use path based unix socket for shims
      and use path-based unix socket for containerd-shim.
    - CVE-2020-15257

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Thu, 26 Nov 2020 18:31:47 +0000

containerd (1.2.6-0ubuntu1~16.04.4) xenial-security; urgency=medium

  * SECURITY UPDATE: Sensitive information disclosure
    - debian/patches/CVE-2020-15157.patch: Improve fetch function and add
      tests for it.
    - CVE-2020-15157

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Wed, 14 Oct 2020 13:21:22 +0000

containerd (1.2.6-0ubuntu1~16.04.3) xenial-security; urgency=medium

  * No change rebuild for the -security pocket

 -- Mike Salvatore <mike.salvatore@canonical.com>  Wed, 03 Jul 2019 08:06:38 -0400

containerd (1.2.6-0ubuntu1~16.04.2) xenial; urgency=medium

  * Increase runc version requirement.

 -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Thu, 16 May 2019 15:43:29 +1200

containerd (1.2.6-0ubuntu1~16.04.1) xenial; urgency=medium

  * Backport to 16.04. (LP: #1824461)
  * Build with golang-1.10-go.
  * Build depend on btrfs-tools, not libbtrfs-dev or btrfs-progs.
  * Re-add Build-Depends: on dh-systemd
  * Disable race testing as go 1.10 race runtime not yet present in Xenial.
  * Add Breaks: docker.io (<= 18.09.3~)

 -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Tue, 16 Apr 2019 13:50:23 +1200

containerd (1.2.6-0ubuntu1) disco; urgency=medium

  * New upstream release.

 -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Fri, 12 Apr 2019 12:28:52 +1200

containerd (1.2.5-0ubuntu1) disco; urgency=medium

  * New upstream release.

 -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Thu, 14 Mar 2019 10:59:45 +1300

containerd (1.2.2-0ubuntu3) disco; urgency=medium

  * Add available docs to containerd package
  * Add "basic-smoke" autopkgtest to verify basic functionality
  * Skip tests on armhf (for now)

 -- Tianon Gravi <tianon@debian.org>  Thu, 14 Feb 2019 14:26:03 -0800

containerd (1.2.2-0ubuntu2) disco; urgency=medium

  * Update "golang-race-detector-runtime" Build-Depends to be amd64-only

 -- Tianon Gravi <tianon@debian.org>  Wed, 13 Feb 2019 16:17:22 -0800

containerd (1.2.2-0ubuntu1) disco; urgency=medium

  * Update to 1.2.2 upstream release

 -- Tianon Gravi <tianon@debian.org>  Thu, 17 Jan 2019 15:40:26 -0800

containerd (0.2.5-0ubuntu2) artful; urgency=medium

  * No change rebuild to fix miscompilation on ppc64el. (LP: #1711935) 

 -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Thu, 24 Aug 2017 20:19:36 +1200

containerd (0.2.5-0ubuntu1) zesty; urgency=medium

  * Update to 0.2.5 upstream release (LP: #1655906)

 -- Tianon Gravi <tianon@debian.org>  Fri, 13 Jan 2017 12:08:00 +1300

containerd (0.2.3-0ubuntu1) yakkety; urgency=medium

  * Update to 0.2.3 upstream release
    - remove "fix-arm64.patch"; applied upstream,
      https://github.com/docker/containerd/pull/226
    - update runc dependency (>= 1.0.0-rc1)

 -- Tianon Gravi <tianon@debian.org>  Wed, 24 Aug 2016 15:44:28 -0700

containerd (0.2.1-0ubuntu4) yakkety; urgency=medium

  * Add d/patches/fix-arm64.patch, a backport of upstream arm64 fixes.

 -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Wed, 06 Jul 2016 14:26:33 +1200

containerd (0.2.1-0ubuntu3) yakkety; urgency=medium

  * Fix "-dev" package Depends, and use vendoring more directly

 -- Tianon Gravi <tianon@debian.org>  Wed, 15 Jun 2016 14:47:15 -0700

containerd (0.2.1-0ubuntu2) yakkety; urgency=medium

  * No change rebuild to pick up s390x fixes.

 -- Michael Hudson-Doyle <michael.hudson@ubuntu.com>  Fri, 10 Jun 2016 15:13:39 +1200

containerd (0.2.1-0ubuntu1) yakkety; urgency=medium

  * Use bundled dependencies for Ubuntu

 -- Tianon Gravi <tianon@debian.org>  Fri, 20 May 2016 09:39:39 -0700

containerd (0.2.1~ds1-1) unstable; urgency=medium

  * Team upload.

  [ Tianon Gravi ]
  * Update to 0.2.1 upstream release

  [ Tim Potter ]
  * Add "golang-github-docker-containerd-dev" package (Closes: #822213)

 -- Dmitry Smirnov <onlyjob@debian.org>  Sat, 23 Apr 2016 22:54:15 +1000

containerd (0.1.0~ds1-1) unstable; urgency=medium

  * Initial release (Closes: #819520)

 -- Tianon Gravi <tianon@debian.org>  Sat, 02 Apr 2016 11:05:01 -0700
