gnupg2 (2.2.27-3ubuntu2.5) jammy-security; urgency=medium

  * SECURITY UPDATE: Remote Code Execution
    - debian/patches/CVE-2025-68973.patch: gpg: Fix possible memory
    corruption in the armor parser.
    - CVE-2025-68973

 -- Allen Huang <allen.huang@canonical.com>  Mon, 05 Jan 2026 22:14:39 +0000

gnupg2 (2.2.27-3ubuntu2.4) jammy-security; urgency=medium

  * debian/patches/fix-key-validity-regression-due-to-CVE-2025-
    30258.patch:
    - Fix a key validity regression following patches for CVE-2025-30258,
      causing trusted "certify-only" primary keys to be ignored when checking
      signature on user IDs and computing key validity. This regression makes
      imported keys signed by a trusted "certify-only" key have an unknown
      validity (LP: #2114775).

 -- dcpi <dcpi@u22vm>  Wed, 25 Jun 2025 13:54:28 +0000

gnupg2 (2.2.27-3ubuntu2.3) jammy-security; urgency=medium

  * SECURITY UPDATE: verification DoS via crafted subkey data
    - debian/patches/CVE-2025-30258-1.patch: lookup key for merging/
      inserting only by primary key in g10/getkey.c, g10/import.c,
      g10/keydb.h.
    - debian/patches/CVE-2025-30258-2.patch: remove a signature check
      function wrapper in g10/mainproc.c, g10/packet.h, g10/sig-check.c.
    - debian/patches/CVE-2025-30258-3.patch: fix a verification DoS due to
      a malicious subkey in the keyring in g10/getkey.c, g10/keydb.h,
      g10/mainproc.c, g10/packet.h, g10/sig-check.c, g10/pkclist.c.
    - debian/patches/CVE-2025-30258-4.patch: fix regression for the recent
      malicious subkey DoS fix in g10/getkey.c, g10/packet.h.
    - debian/patches/CVE-2025-30258-5.patch: fix double free of internal
      data in g10/sig-check.c.
    - CVE-2025-30258

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 28 Mar 2025 13:39:15 -0400

gnupg2 (2.2.27-3ubuntu2.1) jammy-security; urgency=medium

  * SECURITY UPDATE: signature forgery via injection into the status line
    - debian/patches/CVE-2022-34903.patch: Fix garbled status messages in
      NOTATION_DATA in g10/cpr.c.
    - CVE-2022-34903

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 04 Jul 2022 12:17:43 -0400

gnupg2 (2.2.27-3ubuntu2) jammy; urgency=medium

  * No-change rebuild for ppc64el baseline bump.

 -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Wed, 23 Mar 2022 14:55:24 +0100

gnupg2 (2.2.27-3ubuntu1) jammy; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Drop the gpgv-win32 test
    - Honor http_proxy= environment variables by default in the systemd
      user session dirmngr service.
      (debian/patches/dirmngr-honor-http-proxy.patch)
    - Export GPG_AGENT_INFO in the systemd-environment-generator too.
    - Don't declare diffutils as a test dependency, this package is
      essential so always installed; and the dependency declaration breaks
      cross-arch testing.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 29 Dec 2021 15:59:57 -0800

gnupg2 (2.2.27-3) unstable; urgency=medium

  * Avoid network interaction in generator. Closes: #993578
  * Remove build dependency on librsvg2-bin. Closes: #993857
  * Backport "Scd: Fix CCID driver for SCM SPR332/SPR532".
    Closes: #982546
  * Update watch file: Sticking to the 2.2 series for the time being

 -- Christoph Biedl <debian.axhn@manchmal.in-ulm.de>  Sat, 18 Dec 2021 14:04:20 +0100

gnupg2 (2.2.27-2ubuntu1) jammy; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Drop the gpgv-win32 test
    - Honor http_proxy= environment variables by default in the systemd
      user session dirmngr service.
      (debian/patches/dirmngr-honor-http-proxy.patch)
    - Export GPG_AGENT_INFO in the systemd-environment-generator too.
    - Don't declare diffutils as a test dependency, this package is
      essential so always installed; and the dependency declaration breaks
      cross-arch testing.
  * Dropped changes, included upstream:
    - d/p/dirmngr-handle-EAFNOSUPPORT-at-connect_server.patch:
      Fix IPv6 connectivity for dirmngr.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 01 Nov 2021 11:19:52 -0700

gnupg2 (2.2.27-2) unstable; urgency=medium

  * Add a NEWS entry about the end of support for ~/.gnupg/options.
    Closes: #985158

 -- Christoph Biedl <debian.axhn@manchmal.in-ulm.de>  Thu, 22 Apr 2021 20:40:36 +0200

gnupg2 (2.2.27-1) unstable; urgency=medium

  [ NIIBE Yutaka ]
  * New upstream release.

  [ Christoph Biedl ]
  * Tighten libgcrypt and libksba dependency

  [ Daniel Kahn Gillmor ]
  * change debian packaging branch name to debian/main
  * refresh patches using gbp pq
  * point to upstream commit used to improve spawning reliability
  * Refresh 3072-bit default patch
  * standards-version: bump to 4.5.1 (no changes needed)
  * dh: bump to dh 13
  * clean up lintian overrides
  * fully drop symcryptrun

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Mon, 08 Feb 2021 17:57:00 -0500

# For older changelog entries, run 'apt-get changelog gnupg-l10n'
