inetutils (2:2.5-3ubuntu4.2) noble-security; urgency=medium

  * SECURITY UPDATE: privilege escalation in telnetd
    - debian/patches/CVE-2026-28372.patch: prevent authentication
      bypass via CREDENTIALS_DIRECTORY environment variable
    - CVE-2026-28372
  * SECURITY UPDATE: stack-based buffer overflow in telnetd
    - debian/patches/CVE-2026-32746.patch: fix out-of-bounds write in
      LINEMODE SLC suboption handler by checking buffer bounds in
      add_slc
    - CVE-2026-32746
  * SECURITY UPDATE: information disclosure via environment variables
    - debian/patches/CVE-2026-32772.patch: do not send environment
      variables not marked for export to telnetd
    - CVE-2026-32772

 -- Federico Quattrin <federico.quattrin@canonical.com>  Thu, 04 Jun 2026 10:25:04 -0300

inetutils (2:2.5-3ubuntu4.1) noble-security; urgency=medium

  * SECURITY UPDATE: telnetd remote authentication bypass
    - debian/patches/CVE-2026-24061-1.patch: fix injection bug with bogus
      user names in telnetd/utility.c.
    - debian/patches/CVE-2026-24061-2.patch: sanitize all variable
      expansions in telnetd/utility.c.
    - debian/patches/CVE-2026-24061-3.patch: fix compiler warning in
      telnetd/utility.c.
    - CVE-2026-24061

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 30 Jan 2026 11:17:34 -0500

inetutils (2:2.5-3ubuntu4) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 00:08:22 +0000

inetutils (2:2.5-3ubuntu3) noble; urgency=medium

  * No-change rebuild against libcom-err2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 12 Mar 2024 20:33:04 +0000

inetutils (2:2.5-3ubuntu2) noble; urgency=medium

  * No-change rebuild against libcomerr2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 08 Mar 2024 06:47:18 +0000

inetutils (2:2.5-3ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2054684). Remaining changes:
    * Do not test the inetutils-ping package (LP: #2009814)
      - d/t/test-root-commands: disable ping tests
      - d/t/control: remove inetutils-ping dependency

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Thu, 22 Feb 2024 17:18:41 +0200

inetutils (2:2.5-3) unstable; urgency=medium

  * Take DPKG_ROOT into account in maintainer scripts.

 -- Guillem Jover <guillem@debian.org>  Tue, 16 Jan 2024 04:48:45 +0100

inetutils (2:2.5-2) experimental; urgency=medium

  * Move ping programs to their canonical location under /usr, and setup
    backward compatibility symlinks if necessary.

 -- Guillem Jover <guillem@debian.org>  Sun, 07 Jan 2024 04:07:07 +0100

inetutils (2:2.5-1) unstable; urgency=medium

  * New upstream release.
    - Remove patches merged upstream.
    - Update debian/upstream/signing-key.asc.

 -- Guillem Jover <guillem@debian.org>  Fri, 29 Dec 2023 20:08:36 +0100

inetutils (2:2.4-3ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2046259). Remaining changes:
    * Do not test the inetutils-ping package (LP: #2009814)
      - d/t/test-root-commands: disable ping tests
      - d/t/control: remove inetutils-ping dependency
    * Droped d/p/CVE-2023-40303.patch as 2:2.4-3 already carries this patch as
      d/p/upstream/0002-ftpd-rcp-rlogin-rsh-rshd-uucpd-fix-check-set-id-retu.patch

 -- Dominik Viererbe <dominik.viererbe@canonical.com>  Tue, 12 Dec 2023 23:49:39 +0200

# For older changelog entries, run 'apt-get changelog inetutils-telnet'
