libssh (0.12.0-3) unstable; urgency=medium

  * Set DOXYGEN_AWESOME_CSS_DIR build flag to actually use doxygen-awesome-css
    package.  Without it, the build system doesn't see the new build
    dependency. (Closes: #1130941)

 -- Martin Pitt <mpitt@debian.org>  Thu, 19 Mar 2026 12:27:04 +0000

libssh (0.12.0-2) unstable; urgency=medium

  * Add missing doxygen-awesome-css build dep.
    This avoids trying to download the extension from the Internet during
    build. Thanks to Santiago Vila for reporting and Sven Müller for
    figuring out the patch! (Closes: #1130941)
  * libssh-dev: Add missing krb5-multidev dependency.
    Version 0.12 introduced this requirement. Thanks to Simon McVittie!
    (Closes: #1130972)
  * autopkgtest: Port mock-sshd.c to current callback based API.
    Remove usage of the deprecated ssh_message_auth_pubkey() etc. API.
  * autopktest: Test multi-step authentication.
    Our mock ssh server already supports multi-step ("2FA") authentication.
    Expand the test to actually exercise that. Add an askpass script that
    reacts to the various prompts.

 -- Martin Pitt <mpitt@debian.org>  Thu, 19 Mar 2026 10:23:23 +0000

libssh (0.12.0-1) unstable; urgency=medium

  * New upstream security/feature release:
    - CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request()
    - CVE-2026-0965: Possible Denial of Service when parsing unexpected
      configuration files
    - CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input
    - CVE-2026-0967: Specially crafted patterns could cause DoS
    - CVE-2026-0968: OOB Read in sftp_parse_longname()
    - CVE-2026-3731: Read buffer overrun when handling SFTP extensions
    - Note: CVE-2025-14821 is Windows specific, does not apply to Linux
    (Closes: #1127693)
  * Enable new FIDO/U2F support. Build-depend on libfido2-dev.
  * Drop "Priority: optional" field.  Debian Policy 4.7.3 made this obsolete.
    Bump Standards-Version accordingly.

 -- Martin Pitt <mpitt@debian.org>  Sun, 15 Mar 2026 08:56:59 +0000

libssh (0.11.3-1) unstable; urgency=medium

  * New upstream security/bug fix release:
    - CVE-2025-8114: Fix NULL pointer dereference after allocation failure
      (Closes: #1109860)
    - CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated
      wrong KEX (Closes: #1114859)
    - Potential use-after-free when send() fails during key exchange
    - Fix possible timeout during KEX if client sends authentication too early
    - Cleanup OpenSSL PKCS#11 provider when loaded
    - Zeroize buffers containing private key blobs during export

 -- Martin Pitt <mpitt@debian.org>  Sun, 14 Sep 2025 09:54:50 +0200

libssh (0.11.2-1) unstable; urgency=medium

  * New upstream security/bug fix release:
    - CVE-2025-4877: Write beyond bounds in binary to base64 conversion
      functions
    - CVE-2025-4878: Use of uninitialized variable in privatekey_from_file()
    - CVE-2025-5318: Likely read beyond bounds in sftp server handle
      management
    - CVE-2025-5351: Double free in functions exporting keys
    - CVE-2025-5372: ssh_kdf() returns a success code on certain failures
    - CVE-2025-5449: Likely read beyond bounds in sftp server message decoding
    - CVE-2025-5987: Invalid return code for chacha20 poly1305 with OpenSSL
      backend
    (Closes: #1108407)
  * Drop 0001-Fix-multiple-digit-major-version-for-OpenSSH.patch.
    Applied upstream.

 -- Martin Pitt <mpitt@debian.org>  Sat, 28 Jun 2025 07:42:47 +0200

libssh (0.11.1-2) unstable; urgency=medium

  * Fix multiple digit major version for OpenSSH.
    Patch cherry-picked from upstream master. (Closes: #1103224)
  * Update Standards-Version to 4.7.2.  No changes necessary.
  * debian/copyright: Move to FSF URL.
    Fixes "old-fsf-address-in-copyright-file" lintian warning.

 -- Martin Pitt <mpitt@debian.org>  Tue, 22 Apr 2025 12:21:58 +0000

libssh (0.11.1-1) unstable; urgency=medium

  [ Simon Josefsson ]
  * New upstream version 0.11.1 (Closes: #1078677)
  * Add new upstream signing key to d/upstream/signing-key.asc
  * Refresh patches for new upstream release.
    Drop 0001-Fix-regression-in-IPv6-addresses-in-hostname-parsing.patch and
    0002-tests-Increase-test-coverage-for-IPv6-address-parsin.patch, applied
    upstream.
  * Update symbols file
  * Use pkgconf instead of obsolete pkg-config
  * Add d/upstream/metadata
  * Bump d/copyright years

  [ Bastian Germann ]
  * Drop gcrypt flavor (Closes: #1074337)
  * d/copyright: Move blowfish files to their own section

  [ Martin Pitt ]
  * Bump Standards-Version to 4.7.0

  [ Debian Janitor ]
  * debian/control: Remove constraints unnecessary since buster (oldstable)

 -- Martin Pitt <mpitt@debian.org>  Wed, 04 Sep 2024 08:27:52 +0200

libssh (0.10.6-3) unstable; urgency=medium

  * debian/copyright: Add bcrypt_pbkdf.c (Closes: #1071567)

 -- Martin Pitt <mpitt@debian.org>  Mon, 03 Jun 2024 07:32:19 +0200

libssh (0.10.6-2) unstable; urgency=medium

  * Fix regression in IPv6 addresses in hostname parsing.
    Patch and unit test backported from upstream stable-0.10 branch.
    See https://gitlab.com/libssh/libssh-mirror/-/issues/227

 -- Martin Pitt <mpitt@debian.org>  Fri, 22 Dec 2023 16:29:47 +0100

libssh (0.10.6-1) unstable; urgency=high

  * New upstream security release (thus high urgency):
    - Fix Command injection using ProxyCommand
      (CVE-2023-6004, Closes: #1059061)
    - Fix missing checks for return values of MD functions
      (CVE-2023-6918, Closes: #1059059)
    - Fix potential downgrade attack using strict kex
      (CVE-2023-48795, Closes: #1059004)

 -- Martin Pitt <mpitt@debian.org>  Fri, 22 Dec 2023 09:46:12 +0100

libssh (0.10.5-3) unstable; urgency=medium

  * Bump debhelper compat level to 13.
  * Remove compile_commands.json during package cleaning. Fixes "Fails to
    build source after successful build". (Closes: #1045639)

 -- Martin Pitt <mpitt@debian.org>  Fri, 18 Aug 2023 17:01:59 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libssh-doc`.
