glance (2:24.2.1-0ubuntu1.4) jammy-security; urgency=medium

  * d/p/fix-test-no-network.patch: patch calls to socket.getaddrinfo

 -- Federico Quattrin <federico.quattrin@canonical.com>  Wed, 18 Mar 2026 23:17:34 -0300

glance (2:24.2.1-0ubuntu1.3) jammy-security; urgency=medium

  * SECURITY UPDATE: Server-Side Request Forgery (LP: 2138602)
    - d/p/bug-2138602-stable-yoga.patch: fix ssrf vulnerability

 -- Guillaume Boutry <guillaume.boutry@canonical.com>  Wed, 18 Mar 2026 18:25:30 +0100

glance (2:24.2.1-0ubuntu1.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Arbitrary file access via custom QCOW2 external data
    (LP: #2059809)
    - debian/patches/CVE-2024-32498-pre1.patch: limit CaptureRegion sizes
      in format_inspector for VMDK and VHDX.
    - debian/patches/CVE-2024-32498-pre2.patch: support Stream Optimized
      VMDKs.
    - debian/patches/CVE-2024-32498-1.patch: reject qcow files with
      data-file attributes.
    - debian/patches/CVE-2024-32498-2.patch: extend format_inspector for
      QCOW safety.
    - debian/patches/CVE-2024-32498-3.patch: add VMDK safety check.
    - debian/patches/CVE-2024-32498-4.patch: reject unsafe qcow and vmdk
      files.
    - debian/patches/CVE-2024-32498-5.patch: add QED format detection to
      format_inspector.
    - debian/patches/CVE-2024-32498-6.patch: add file format detection to
      format_inspector.
    - debian/patches/CVE-2024-32498-7.patch: add safety check and detection
      support to FI tool.
    - CVE-2024-32498

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 28 Jun 2024 18:04:05 -0400

glance (2:24.2.1-0ubuntu1) jammy; urgency=medium

  * New stable point release for OpenStack Yoga (LP: #2037332).

 -- Corey Bryant <corey.bryant@canonical.com>  Mon, 25 Sep 2023 17:19:32 -0400

glance (2:24.2.0-0ubuntu1) jammy; urgency=medium

  * New stable point release for OpenStack Yoga (LP: #2011713).
  * d/p/CVE-2022-47951.patch: Dropped. Fixed in stable point release.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 15 Mar 2023 09:00:42 -0400

glance (2:24.1.0-0ubuntu1.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Arbitrary file access
    - debian/patches/CVE-2022-47951.patch: Enforce image safety
      during image_conversion.
    - CVE-2022-47951

 -- Corey Bryant <corey.bryant@canonical.com>  Sun, 29 Jan 2023 10:35:56 -0500

glance (2:24.1.0-0ubuntu1) jammy; urgency=medium

  * d/gbp.conf: Create stable/yoga branch.
  * New stable point release for OpenStack Yoga (LP: #1980369).

 -- Corey Bryant <corey.bryant@canonical.com>  Tue, 05 Jul 2022 10:43:59 -0400

glance (2:24.0.0-0ubuntu1) jammy; urgency=medium

  * d/watch: Scope to 24.x.
  * New upstream release for OpenStack Yoga.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 30 Mar 2022 16:36:07 -0400

glance (2:24.0.0~rc1+git2022030311.d4119be05-0ubuntu1) jammy; urgency=medium

  * New upstream snapshot for OpenStack Yoga.
  * d/control: Align (Build-)Depends with upstream.
  * d/p/skip-py10-failure.patch: Dropped. Fixed in upstream snapshot.

 -- Corey Bryant <corey.bryant@canonical.com>  Thu, 03 Mar 2022 11:12:09 -0500

glance (2:23.0.0+git2022011216.502fa0ffc-0ubuntu1) jammy; urgency=medium

  * d/glance-common.install, d/glance-api.init.in: Install
    glance-image-import.conf.sample and add --config-dir=/etc/glance/
    to glance-api init script (LP: #1955022).
  * New upstream snapshot for OpenStack Yoga.
  * d/control, d/rules: Bump debhelper compat to 13.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 12 Jan 2022 16:47:24 -0500

# For older changelog entries, run 'apt-get changelog glance-common'
