libssh (0.11.3-1ubuntu2) resolute; urgency=medium

  * SECURITY UPDATE: out-of-bound read
    - debian/patches/CVE-2026-3731.patch: correct bounds checks when querying
      for an SFTP extension name or data in src/sftp.c.
    - CVE-2026-3731

 -- Ian Constantin <ian.constantin@canonical.com>  Wed, 11 Mar 2026 12:19:35 +0200

libssh (0.11.3-1ubuntu1) resolute; urgency=medium

  * SECURITY UPDATE: Improper sanitation of paths received from SCP servers
    - debian/patches/CVE-2026-0964.patch: reject invalid paths received
      through scp in src/scp.c.
    - CVE-2026-0964
  * SECURITY UPDATE: DoS via improper configuration file handling
    - debian/patches/CVE-2026-0965.patch: do not attempt to read
      non-regular and too large configuration files in
      include/libssh/misc.h, include/libssh/priv.h, src/bind_config.c,
      src/config.c, src/dh-gex.c, src/known_hosts.c, src/knownhosts.c,
      src/misc.c, tests/unittests/torture_config.c.
    - CVE-2026-0965
  * SECURITY UPDATE: Buffer underflow in ssh_get_hexa() on invalid input
    - debian/patches/CVE-2026-0966-1.patch: avoid heap buffer underflow in
      ssh_get_hexa in src/misc.c.
    - debian/patches/CVE-2026-0966-2.patch: test coverage for ssh_get_hexa
      in tests/unittests/torture_misc.c.
    - debian/patches/CVE-2026-0966-3.patch: update guided tour to use
      SHA256 fingerprints in doc/guided_tour.dox.
    - CVE-2026-0966
  * SECURITY UPDATE: DoS via inefficient regular expression processing
    - debian/patches/CVE-2026-0967.patch: avoid recursive matching (ReDoS)
      in src/match.c, tests/unittests/torture_config.c.
    - CVE-2026-0967
  * SECURITY UPDATE: DoS due to malformed SFTP message
    - debian/patches/CVE-2026-0968-1.patch: sanitize input handling in
      sftp_parse_longname() in src/sftp_common.c.
    - debian/patches/CVE-2026-0968-2.patch: reproducer for invalid longname
      data in tests/unittests/CMakeLists.txt,
      tests/unittests/torture_unit_sftp.c.
    - CVE-2026-0968

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 18 Feb 2026 08:45:14 -0500

libssh (0.11.3-1) unstable; urgency=medium

  * New upstream security/bug fix release:
    - CVE-2025-8114: Fix NULL pointer dereference after allocation failure
      (Closes: #1109860)
    - CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated
      wrong KEX (Closes: #1114859)
    - Potential use-after-free when send() fails during key exchange
    - Fix possible timeout during KEX if client sends authentication too early
    - Cleanup OpenSSL PKCS#11 provider when loaded
    - Zeroize buffers containing private key blobs during export

 -- Martin Pitt <mpitt@debian.org>  Sun, 14 Sep 2025 09:54:50 +0200

libssh (0.11.2-1) unstable; urgency=medium

  * New upstream security/bug fix release:
    - CVE-2025-4877: Write beyond bounds in binary to base64 conversion
      functions
    - CVE-2025-4878: Use of uninitialized variable in privatekey_from_file()
    - CVE-2025-5318: Likely read beyond bounds in sftp server handle
      management
    - CVE-2025-5351: Double free in functions exporting keys
    - CVE-2025-5372: ssh_kdf() returns a success code on certain failures
    - CVE-2025-5449: Likely read beyond bounds in sftp server message decoding
    - CVE-2025-5987: Invalid return code for chacha20 poly1305 with OpenSSL
      backend
    (Closes: #1108407)
  * Drop 0001-Fix-multiple-digit-major-version-for-OpenSSH.patch.
    Applied upstream.

 -- Martin Pitt <mpitt@debian.org>  Sat, 28 Jun 2025 07:42:47 +0200

libssh (0.11.1-2) unstable; urgency=medium

  * Fix multiple digit major version for OpenSSH.
    Patch cherry-picked from upstream master. (Closes: #1103224)
  * Update Standards-Version to 4.7.2.  No changes necessary.
  * debian/copyright: Move to FSF URL.
    Fixes "old-fsf-address-in-copyright-file" lintian warning.

 -- Martin Pitt <mpitt@debian.org>  Tue, 22 Apr 2025 12:21:58 +0000

libssh (0.11.1-1) unstable; urgency=medium

  [ Simon Josefsson ]
  * New upstream version 0.11.1 (Closes: #1078677)
  * Add new upstream signing key to d/upstream/signing-key.asc
  * Refresh patches for new upstream release.
    Drop 0001-Fix-regression-in-IPv6-addresses-in-hostname-parsing.patch and
    0002-tests-Increase-test-coverage-for-IPv6-address-parsin.patch, applied
    upstream.
  * Update symbols file
  * Use pkgconf instead of obsolete pkg-config
  * Add d/upstream/metadata
  * Bump d/copyright years

  [ Bastian Germann ]
  * Drop gcrypt flavor (Closes: #1074337)
  * d/copyright: Move blowfish files to their own section

  [ Martin Pitt ]
  * Bump Standards-Version to 4.7.0

  [ Debian Janitor ]
  * debian/control: Remove constraints unnecessary since buster (oldstable)

 -- Martin Pitt <mpitt@debian.org>  Wed, 04 Sep 2024 08:27:52 +0200

libssh (0.10.6-3) unstable; urgency=medium

  * debian/copyright: Add bcrypt_pbkdf.c (Closes: #1071567)

 -- Martin Pitt <mpitt@debian.org>  Mon, 03 Jun 2024 07:32:19 +0200

libssh (0.10.6-2) unstable; urgency=medium

  * Fix regression in IPv6 addresses in hostname parsing.
    Patch and unit test backported from upstream stable-0.10 branch.
    See https://gitlab.com/libssh/libssh-mirror/-/issues/227

 -- Martin Pitt <mpitt@debian.org>  Fri, 22 Dec 2023 16:29:47 +0100

libssh (0.10.6-1) unstable; urgency=high

  * New upstream security release (thus high urgency):
    - Fix Command injection using ProxyCommand
      (CVE-2023-6004, Closes: #1059061)
    - Fix missing checks for return values of MD functions
      (CVE-2023-6918, Closes: #1059059)
    - Fix potential downgrade attack using strict kex
      (CVE-2023-48795, Closes: #1059004)

 -- Martin Pitt <mpitt@debian.org>  Fri, 22 Dec 2023 09:46:12 +0100

libssh (0.10.5-3) unstable; urgency=medium

  * Bump debhelper compat level to 13.
  * Remove compile_commands.json during package cleaning. Fixes "Fails to
    build source after successful build". (Closes: #1045639)

 -- Martin Pitt <mpitt@debian.org>  Fri, 18 Aug 2023 17:01:59 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libssh-4`.
