systemd (229-4ubuntu21.21) xenial-security; urgency=medium

  * SECURITY UDPATE: Unsafe environment usage in pam_systemd.so leads to
    incorrect Policykit authorization
    - debian/patches/CVE-2019-3842.patch: Use secure_getenv() rather than
      getenv() in pam_systemd.c
    - CVE-2019-3842

 -- Chris Coulson <chris.coulson@canonical.com>  Fri, 29 Mar 2019 16:43:00 +0000

systemd (229-4ubuntu21.19) xenial; urgency=medium

  [ Michael Vogt ]
  * d/p/fix-race-daemon-reload-11121.patch:
    - backport systemd upstream PR#8803 and PR#11121 to fix race
      when doing systemctl and systemctl daemon-reload at the
      same time LP: #1819728

  [ Balint Reczey ]
  * d/p/virt-detect-WSL-environment-as-a-container.patch:
    - virt: detect WSL environment as a container (LP: #1816753)

 -- Michael Vogt <michael.vogt@ubuntu.com>  Mon, 25 Mar 2019 16:04:56 +0100

systemd (229-4ubuntu21.18) xenial; urgency=medium

  * d/p/fix-race-daemon-reload-8803.patch:
    - backport systemd upstream PR#8803 to fix race when doing
      systemctl and systemctl daemon-reload at the same time
      LP: #1819728

 -- Michael Vogt <michael.vogt@ubuntu.com>  Wed, 13 Mar 2019 16:17:45 +0100

systemd (229-4ubuntu21.17) xenial; urgency=medium

  [ Victor Tapia ]
  * d/p/stop-mount-error-propagation.patch:
    keep mount errors local to the failing mount point instead of blocking
    the processing of all mounts (LP: #1755863)

  [ Eric Desrochers ]
  * d/p/fix-egde-case-when-processing-proc-self-mountinfo.patch:
    Mounting any file system to a mount point in a directory
    that is bind mounted to itself will create an inactive
    mount unit. (LP: #1795764)

 -- Dan Streetman <ddstreet@canonical.com>  Thu, 28 Feb 2019 17:50:50 -0500

systemd (229-4ubuntu21.16) xenial-security; urgency=medium

  * SECURITY UPDATE: denial of service via crafted dbus message
    - debian/patches/CVE-2019-6454.patch: sd-bus: enforce a size limit for
      dbus paths, and don't allocate them on the stack
    - debian/patches/sd-bus-if-we-receive-an-invalid-dbus-message-ignore-.patch:
      sd-bus: if we receive an invalid dbus message, ignore and proceeed
    - CVE-2019-6454

  * Do not remove multiple spaces after identifier in syslog message
    - add debian/patches/journal-do-not-remove-multiple-spaces-after-identifi.patch

 -- Chris Coulson <chris.coulson@canonical.com>  Wed, 13 Feb 2019 22:03:22 +0000

systemd (229-4ubuntu21.15) xenial-security; urgency=medium

  * SECURITY UPDATE: memory corruption in journald via attacker controlled alloca
    - debian/patches/CVE-2018-16864.patch: journald: do not store the iovec
      entry for process commandline on the stack
    - CVE-2018-16864
  * SECURITY UPDATE: memory corruption in journald via attacker controlled alloca
    - debian/patches/CVE-2018-16865_1.patch: journald: set a limit on the
      number of fields (1k)
    - debian/patches/CVE-2018-16865_2.patch: journal-remote: set a limit on the
      number of fields in a message
    - CVE-2018-16865
  * SECURITY UPDATE: out-of-bounds read in journald
    - debian/patches/CVE-2018-16866.patch: journal: fix syslog_parse_identifier()
    - CVE-2018-16866
  * SECURITY UPDATE: symlink mishandling in systemd-tmpfiles
    - debian/patches/CVE-2018-6954.patch: don't resolve pathnames when traversing
      recursively through directory trees
    - debian/patches/CVE-2018-6954_2.patch: backport the remaining patches to
      resolve this completely
    - CVE-2018-6954

  * Fix LP: #1804603 - btrfs-util: unbreak tmpfiles' subvol creation
    - add debian/patches/btrfs-util-unbreak-tmpfiles-subvol-creation.patch
    - update debian/patches/series
  * Fix LP: #1804864 - test: Set executable bits on TEST-22-TMPFILES shell scripts
    - add debian/patches/test-Set-executable-bits-on-TEST-22-TMPFILES-shell-script.patch
    - update debian/patches/series

 -- Chris Coulson <chris.coulson@canonical.com>  Thu, 10 Jan 2019 00:15:47 +0000

systemd (229-4ubuntu21.10) xenial-security; urgency=medium

  [ Chris Coulson ]
  * Revert the fixes for CVE-2018-6954 for causing a regression when running
    in a container on old kernels (LP: #1804847)
    - update debian/patches/series

  [ Balint Reczey ]
  * Fix LP: #1803391 - Don't always trigger systemctl stop of udev service
    and sockets
    - update debian/udev.postinst

 -- Chris Coulson <chris.coulson@canonical.com>  Tue, 27 Nov 2018 11:10:48 +0000

systemd (229-4ubuntu21.9) xenial-security; urgency=medium

  * SECURITY UPDATE: symlink mishandling in systemd-tmpfiles
    - debian/patches/CVE-2018-6954_2.patch: backport the remaining patches to
      resolve this completely
    - CVE-2018-6954

 -- Chris Coulson <chris.coulson@canonical.com>  Thu, 15 Nov 2018 21:02:00 +0000

systemd (229-4ubuntu21.8) xenial-security; urgency=medium

  * SECURITY UPDATE: reexec state injection
    - debian/patches/CVE-2018-15686.patch: when deserializing state always use
      read_line(…, LONG_LINE_MAX, …) rather than fgets()
    - CVE-2018-15686
  * SECURITY UPDATE: symlink mishandling in systemd-tmpfiles
    - debian/patches/CVE-2018-6954.patch: don't resolve pathnames when traversing
      recursively through directory trees
    - CVE-2018-6954

 -- Chris Coulson <chris.coulson@canonical.com>  Thu, 08 Nov 2018 00:01:30 +0000

systemd (229-4ubuntu21.6) xenial-security; urgency=medium

  * SECURITY UPDATE: buffer overflow in dhcp6 client
    - debian/patches/CVE-2018-15688.patch:  make sure we have enough space
      for the DHCP6 option header in src/libsystemd-network/dhcp6-option.c.
    - CVE-2018-15688

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 31 Oct 2018 11:39:02 -0400

# For older changelog entries, run 'apt-get changelog libnss-myhostname'