Ubuntu
dotnet6 package

[SRU] New upstream microrelease 6.0.112

Bug #1999549 reported by Miriam España Acebal
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
dotnet6 (Ubuntu)
Fix Released
High
Miriam España Acebal
Jammy
Fix Released
High
Miriam España Acebal
Kinetic
Fix Released
High
Miriam España Acebal
Lunar
Fix Released
High
Miriam España Acebal

Bug Description

[Impact]

This corresponds to an upstream microrelease (Microsoft Patch Tuesday microrelease).
It contains minor bug fixes and new features. It also contains a CVE, but only applies to Windows systems (so doing this upgrade trough -updates).

We also fix here the following two bugs: (LP: #1999266) (LP: #1997746)

[Test Case]

The usual manual tests that have been seen in the previous microreleases [1] [2] (see Test Case section there). They cover the fixes too, but for more specific checks:

# LP: #1999266: Check the install_location files are in /etc/dotnet:

$ l /etc/dotnet/
install_location install_location_x64

# LP: #1997746: after log out/log in, check DOTNET_ROOT variable is set to /usr/lib/dotnet

$ env | grep DOTNET
DOTNET_ROOT=/usr/lib/dotnet
DOTNET_BUNDLE_EXTRACT_BASE_DIR=/root/.cache/dotnet_bundle_extract

[Regression Potential]

Upstreams tests are usually great, but nevertheless there always is a risk for something to break.

If the solution would not be well implemented, the dotnet-host binary will be unable to recognize the SDKs installed and all the other shared files (templates, packs, etc...).

For the fixes, we can overwrite DOTNET_ROOT if the user set himself/herself differently,
and if someone linked the install_location files in the previous version as workaround might
encounter some issues during installation.

[Other info]

It will be published in the MS page when it went GA version (13th Dec).

[1] https://bugs.launchpad.net/ubuntu/+source/dotnet6/+bug/1996499
[2] https://bugs.launchpad.net/ubuntu/jammy/+source/dotnet6/+bug/1983380

See original description

CVE References

Miriam España Acebal (mirespace)
Changed in dotnet6 (Ubuntu Jammy):
assignee: nobody → Miriam España Acebal (mirespace)
Changed in dotnet6 (Ubuntu Kinetic):
assignee: nobody → Miriam España Acebal (mirespace)
Changed in dotnet6 (Ubuntu Lunar):
assignee: nobody → Miriam España Acebal (mirespace)
Changed in dotnet6 (Ubuntu Jammy):
status: New → In Progress
Changed in dotnet6 (Ubuntu Kinetic):
status: New → In Progress
Changed in dotnet6 (Ubuntu Lunar):
status: New → In Progress
Miriam España Acebal (mirespace)
Changed in dotnet6 (Ubuntu Jammy):
importance: Undecided → High
Changed in dotnet6 (Ubuntu Kinetic):
importance: Undecided → High
Changed in dotnet6 (Ubuntu Lunar):
importance: Undecided → High
description: updated
Graham Inggs (ginggs)
summary: - New upstream microrelease 6.0.112
+ [SRU] New upstream microrelease 6.0.112
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package dotnet6 - 6.0.112-0ubuntu1

---------------
dotnet6 (6.0.112-0ubuntu1) lunar; urgency=medium

  * New upstream release (LP: #1999549).
  * d/p/series: Removing patch
    73065-runtime-fix-definition-cpuid-clang-15.patch.
  * d/dotnet-host.install.in: Fix destination of install_location*
    files (LP: #1999266).
  * d/dotnet.sh.in: Eliminate the condition to force updating of
    DOTNET_ROOT variable (LP: #1997746).

 -- Miriam España Acebal <email address hidden> Tue, 13 Dec 2022 11:03:19 +0100

Changed in dotnet6 (Ubuntu Lunar):
status: In Progress → Fix Released
Revision history for this message
Łukasz Zemczak (sil2100) wrote : Please test proposed package

Hello Miriam, or anyone else affected,

Accepted dotnet6 into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dotnet6/6.0.112-0ubuntu1~22.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in dotnet6 (Ubuntu Kinetic):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-kinetic
Revision history for this message
Łukasz Zemczak (sil2100) wrote :

Hello Miriam, or anyone else affected,

Accepted dotnet6 into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dotnet6/6.0.112-0ubuntu1~22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in dotnet6 (Ubuntu Jammy):
status: In Progress → Fix Committed
tags: added: verification-needed-jammy
Revision history for this message
Miriam España Acebal (mirespace) wrote :
Download full text (7.3 KiB)

Verification on Jammy: OK

#0.Check installation:

root@Jdotnet6-112:~# dotnet --info
.NET SDK (reflecting any global.json):
 Version: 6.0.112
 Commit: d311a58ee1

Runtime Environment:
 OS Name: ubuntu
 OS Version: 22.04
 OS Platform: Linux
 RID: ubuntu.22.04-x64
 Base Path: /usr/lib/dotnet/sdk/6.0.112/

global.json file:
  Not found

Host:
  Version: 6.0.12
  Architecture: x64
  Commit: 02e45a41b7

.NET SDKs installed:
  6.0.112 [/usr/lib/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 6.0.12 [/usr/lib/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 6.0.12 [/usr/lib/dotnet/shared/Microsoft.NETCore.App]

Download .NET:
  https://aka.ms/dotnet-download

Learn about .NET Runtimes and SDKs:
  https://aka.ms/dotnet/runtimes-sdk-info
root@Jdotnet6-112:~# dotnet --version
6.0.112
root@Jdotnet6-112:~# dotnet sdk check

Welcome to .NET 6.0!
---------------------
SDK Version: 6.0.112

----------------
Installed an ASP.NET Core HTTPS development certificate.
To trust the certificate run 'dotnet dev-certs https --trust' (Windows and macOS only).
Learn about HTTPS: https://aka.ms/dotnet-https
----------------
Write your first app: https://aka.ms/dotnet-hello-world
Find out what's new: https://aka.ms/dotnet-whats-new
Explore documentation: https://aka.ms/dotnet-docs
Report issues and find source on GitHub: https://github.com/dotnet/core
Use 'dotnet --help' to see available commands or visit: https://aka.ms/dotnet-cli
--------------------------------------------------------------------------------------
.NET SDKs:
Version Status
------------------------
6.0.112 Up to date.

Try out the newest .NET SDK features with .NET 7.0.101.

.NET Runtimes:
Name Version Status
------------------------------------------------------
Microsoft.AspNetCore.App 6.0.12 Up to date.
Microsoft.NETCore.App 6.0.12 Up to date.

The latest versions of .NET can be installed from https://aka.ms/dotnet-core-download. For more information about .NET lifecycles, see https://aka.ms/dotnet-core-support.

root@Jdotnet6-112:~#

#2. Checking console, solution and project commands:

root@Jdotnet6-112:~# dotnet new console --name TheTesting
The template "Console App" was created successfully.

Processing post-creation actions...
Running 'dotnet restore' on /root/TheTesting/TheTesting.csproj...
  Determining projects to restore...
  Restored /root/TheTesting/TheTesting.csproj (in 92 ms).
Restore succeeded.

root@Jdotnet6-112:~# cd TheTesting/
root@Jdotnet6-112:~/TheTesting# dotnet new sln
The template "Solution File" was created successfully.
root@Jdotnet6-112:~/TheTesting# dotnet sln TheTesting.sln add TheTesting.csproj
Project `TheTesting.csproj` added to the solution.
root@Jdotnet6-112:~/TheTesting# dotnet build TheTesting.sln
Microsoft (R) Build Engine version 17.0.1+b177f8fa7 for .NET
Copyright (C) Microsoft Corporation. All rights reserved.

  Determining projects to restore...
  All projects are up-to-date for restore.
  TheTesting -> /root/TheTesting/bin/Debug/net6.0/TheTesting.dll

Build succeeded.
    0 Warning(s)
    0 Error(s)

Time Elapsed 00:...

Read more...

tags: added: verification-done-jammy
removed: verification-needed-jammy
Revision history for this message
Łukasz Zemczak (sil2100) wrote :

Hello Miriam, or anyone else affected,

Accepted dotnet6 into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dotnet6/6.0.112-0ubuntu1~22.10.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Revision history for this message
Graham Inggs (ginggs) wrote :
Download full text (6.9 KiB)

#1. Basic check commands:

$ dotnet --info
.NET SDK (reflecting any global.json):
 Version: 6.0.112
 Commit: d311a58ee1

Runtime Environment:
 OS Name: ubuntu
 OS Version: 22.10
 OS Platform: Linux
 RID: ubuntu.22.10-x64
 Base Path: /usr/lib/dotnet/sdk/6.0.112/

global.json file:
  Not found

Host:
  Version: 6.0.12
  Architecture: x64
  Commit: 02e45a41b7

.NET SDKs installed:
  6.0.112 [/usr/lib/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 6.0.12 [/usr/lib/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 6.0.12 [/usr/lib/dotnet/shared/Microsoft.NETCore.App]

Download .NET:
  https://aka.ms/dotnet-download

Learn about .NET Runtimes and SDKs:
  https://aka.ms/dotnet/runtimes-sdk-info

$ dotnet --version
6.0.112

$ dotnet sdk check

Welcome to .NET 6.0!
---------------------
SDK Version: 6.0.112

----------------
Installed an ASP.NET Core HTTPS development certificate.
To trust the certificate run 'dotnet dev-certs https --trust' (Windows and macOS only).
Learn about HTTPS: https://aka.ms/dotnet-https
----------------
Write your first app: https://aka.ms/dotnet-hello-world
Find out what's new: https://aka.ms/dotnet-whats-new
Explore documentation: https://aka.ms/dotnet-docs
Report issues and find source on GitHub: https://github.com/dotnet/core
Use 'dotnet --help' to see available commands or visit: https://aka.ms/dotnet-cli
--------------------------------------------------------------------------------------
.NET SDKs:
Version Status
------------------------
6.0.112 Up to date.

Try out the newest .NET SDK features with .NET 7.0.101.

.NET Runtimes:
Name Version Status
------------------------------------------------------
Microsoft.AspNetCore.App 6.0.12 Up to date.
Microsoft.NETCore.App 6.0.12 Up to date.

The latest versions of .NET can be installed from https://aka.ms/dotnet-core-download. For more information about .NET lifecycles, see https://aka.ms/dotnet-core-support.

#2. Checking console, solution and project commands:

$ dotnet new console --name TheTesting
The template "Console App" was created successfully.

Processing post-creation actions...
Running 'dotnet restore' on /home/ubuntu/TheTesting/TheTesting.csproj...
  Determining projects to restore...
  Restored /home/ubuntu/TheTesting/TheTesting.csproj (in 72 ms).
Restore succeeded.

$ cd TheTesting/

$ dotnet new sln
The template "Solution File" was created successfully.

$ dotnet sln TheTesting.sln add TheTesting.csproj
Project `TheTesting.csproj` added to the solution.

$ dotnet build TheTesting.sln
Microsoft (R) Build Engine version 17.0.1+b177f8fa7 for .NET
Copyright (C) Microsoft Corporation. All rights reserved.

  Determining projects to restore...
  All projects are up-to-date for restore.
  TheTesting -> /home/ubuntu/TheTesting/bin/Debug/net6.0/TheTesting.dll

Build succeeded.
    0 Warning(s)
    0 Error(s)

Time Elapsed 00:00:01.97

$ bin/Debug/net6.0/TheTesting
Hello, World!

$ cat <<EOF >Program.cs
          using System;
          using System.Collections.Generic;
          using System.Linq;
          using System.Text;
  ...

Read more...

tags: added: verification-done verification-done-kinetic
removed: verification-needed verification-needed-kinetic
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package dotnet6 - 6.0.113-0ubuntu1~22.04.1

---------------
dotnet6 (6.0.113-0ubuntu1~22.04.1) jammy-security; urgency=medium

  * New upstream release.
  * SECURITY UPDATE: denial of service
    - CVE-2023-21538: Parsing an empty HTTP response as a JSON.NET JObject
      causes a stack overflow and crashes a process.

 -- Ian Constantin <email address hidden> Mon, 09 Jan 2023 22:04:18 +0200

Changed in dotnet6 (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package dotnet6 - 6.0.113-0ubuntu1~22.10.1

---------------
dotnet6 (6.0.113-0ubuntu1~22.10.1) kinetic-security; urgency=medium

  * New upstream release.
  * SECURITY UPDATE: denial of service
    - CVE-2023-21538: Parsing an empty HTTP response as a JSON.NET JObject
      causes a stack overflow and crashes a process.

 -- Ian Constantin <email address hidden> Mon, 09 Jan 2023 22:08:22 +0200

Changed in dotnet6 (Ubuntu Kinetic):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.