squid (7.2-2ubuntu2) resolute; urgency=medium

  * SECURITY UPDATE: use-after-free via ICP protocol
    - debian/patches/CVE-2026-32748.patch: fix HttpRequest lifetime for ICP
      v3 queries in src/ICP.h, src/icp_v2.cc, src/icp_v3.cc,
      src/tests/stub_icp.cc.
    - CVE-2026-32748
  * SECURITY UPDATE: out-of-bounds read via ICP protocol
    - debian/patches/CVE-2026-33515.patch: fix validation of packet sizes
      and URLs in src/ICP.h, src/icp_v2.cc, src/icp_v3.cc,
      src/tests/stub_icp.cc.
    - CVE-2026-33515
  * SECURITY UPDATE: use-after-free via ICP protocol
    - debian/patches/CVE-2026-33526.patch: do not escape malformed URI
      twice when sending ICP errors in src/icp_v2.cc.
    - CVE-2026-33526

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 02 Apr 2026 13:07:11 -0400

squid (7.2-2ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2126018). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
    - d/source_squid.py, d/rules: Add apport hook (LP #676141)
  * New changes:
    - d/squid-openssl.links: fix broken manpage link for squid-openssl.
  * Dropped changes:
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
      [ Applied upstream in version 7.0.2 ]
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
      [ Applied upstream in version 7.0.2 ]
    - lp-2125118-*: Fix FTBFS with GCC-15 (LP #2125118)
      [ Applied upstream in version 7.0.2 ]
    - debian/patches/CVE-2025-59362.patch: fix ASN.1 encoding of long SNMP OIDs
      in lib/snmplib/asn1.c. (CVE-2025-59362)
      [ Applied upstream in version 7.2 ]
    - d/p/CVE-2025-62168.patch: Add maskSensitiveInfo parameter to
      pack and pass it to packInto in src/HttpRequest.cc. Add maskSensitiveInfo
      to pack in src/HttpRequest.h. Adapt code with new parameter in
      src/client_side_reply.cc, and src/errorpage.cc. Remove request_hdr NULL
      assign in src/errorpage.h. (CVE-2025-62168)
      [ Applied upstream in version 7.2 ]
    - d/rules: disable LTO related compilation errors for ppc64el builds.
      [ No more needed in version 7.2-2 in resolute ]

 -- Renan Rodrigo <rr@ubuntu.com>  Wed, 26 Nov 2025 15:36:40 -0300

squid (7.2-2) unstable; urgency=high

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/patches/0008-upstream-ab5cf0c36b538627c82b3989d6c87d1668c7e081.patch
    - Added upstream patch fixing error on CONNECT to hosts starting with
      digit

 -- Luigi Gangitano <luigi@debian.org>  Thu, 23 Oct 2025 19:18:11 +0200

squid (7.2-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 7.2 (Closes: #1080997)
    Fixes: CVE-2025-62168. SQUID-2025:2 (Closes: #1118341)
    Fixes: CVE-2025-59362 (Closes: #1117048)

  * debian/watch
    - remove check for files no longer provided upstream

  * debian/control
    - support libkrb5 provided by krb5-multidev package

 -- Luigi Gangitano <luigi@debian.org>  Wed, 22 Oct	2025 16:58:20 +0200

squid (7.1-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 7.1 (Closes: #1097927, #1015670)

  * Drop binaries removed upstream
    - ntlm_smb_lm_auth (Fixes: CVE-2025-21311)
    - squid-purge
    - squid-cgi
    - squidclient

  * Remove workaround for CVE-2024-45802, integrated upstream.

  * debian/patches/
    - refresh patches for new version

 -- Luigi Gangitano <luigi@debian.org>  Mon, 14 Jul 2025 10:58:20 +0200

squid (6.13-2) unstable; urgency=low

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * debian/control
    - Bumped Standards-Version to 4.7.2, no change needed
    - Add Build-Dep on libcrypt-dev (Closes: #1106998)

  * debian/squid-openssl.links
    - Add symlink for man8 file

  * debian/squid.postrm
    - Remove no longer necessary workaround for Bug #984897

 -- Luigi Gangitano <luigi@debian.org>  Mon,  9 Jun 2025 10:35:20 +0200

squid (6.13-1ubuntu5) resolute; urgency=medium

  * SECURITY UPDATE: HTTP Authentication credential leak
    - debian/patches/CVE-2025-62168.patch: Add maskSensitiveInfo parameter to
      pack and pass it to packInto in src/HttpRequest.cc. Add maskSensitiveInfo
      to pack in src/HttpRequest.h. Adapt code with new parameter in
      src/client_side_reply.cc, and src/errorpage.cc. Remove request_hdr NULL
      assign in src/errorpage.h.
    - CVE-2025-62168

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Tue, 28 Oct 2025 14:58:21 -0230

squid (6.13-1ubuntu4) questing; urgency=medium

  * SECURITY UPDATE: ASN.1 encoding mishandling
    - debian/patches/CVE-2025-59362.patch: fix ASN.1 encoding of long SNMP
      OIDs in lib/snmplib/asn1.c.
    - CVE-2025-59362

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 03 Oct 2025 09:30:30 -0400

squid (6.13-1ubuntu3) questing; urgency=medium

  * lp-2125118-*: Fix FTBFS with GCC-15 (LP: #2125118)

 -- Christian Ehrhardt <christian.ehrhardt@canonical.com>  Thu, 18 Sep 2025 15:59:23 +0200

squid (6.13-1ubuntu2) questing; urgency=medium

  * No-change rebuild for libxml2 soname change.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 20 May 2025 12:24:33 +0200

squid (6.13-1ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2097411). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
    - d/rules: disable LTO related compilation errors for ppc64el builds.
    - d/source_squid.py, d/rules: Add apport hook (LP #676141)
  * Dropped changes:
    - d/p/0011-Fix-uninitialized-end-variable.patch: Fix FTBFS on
      uninitialized variable by adding null ptr checking.
      (LP: #2093295)
      [ Fixed in 6.13 ]

 -- Renan Rodrigo <renanrodrigo@canonical.com>  Mon, 17 Feb 2025 15:54:27 -0300

squid (6.13-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.13 (Closes: #956581)

  * debian/watch
    - update for new upstream release location

  * debian/squid{,-openssl}.alternatives
    - switch alternatives priority (Closes: #1086537)

  * debian/squid.tmpfile
    - fix warning: The name debian/squid.tmpfile is deprecated
      please use debian/squid.tmpfiles instead

  * debian/NEWS
    - fix lintian warning syntax-error-in-debian-news-file

 -- Luigi Gangitano <luigi@debian.org>  Tue, 11 Feb 2025 12:35:20 +0100

squid (6.12-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.12 (Closes: #1063877)

  * Disable ESI feature support
    Fixes: CVE-2024-45802. SQUID-2024:4

  * debian/{control,rules}
    - Migrate from lsb-release to os-release.
    - Remove deprecated lsb-base dependency. It has been
      replaced by sysvinit-utils in essential packages.
    - Polish user visible package descriptions.
    - Restructure rules special-cases for easier team maintenance.

  * Use alternatives system for squid binary

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/control
    - Add Rules-Requires-Root: binary-targets
    - Bumped Standards-Version to 4.7.0, no change needed

  * debian/patches/*
    - Refreshed patches
    - Added description to 0006-upstream-807ae4df2164defbb5f59b99282e24010b4a0b85.patch

  * debian/upstream/signing-key.asc
    - Added Francesco Chemolli's key to the authorized keys (Closes: #1084734)

  [ Sven Auhagen <sven.auhagen@voleatech.de> ]
  * debian/squid.postinst
    - Check if cache folder exists before using chown

 -- Luigi Gangitano <luigi@debian.org>  Mon, 28 Oct 2024 11:04:20 +0100

squid (6.10-1ubuntu2) plucky; urgency=medium

  * d/p/0011-Fix-uninitialized-end-variable.patch: Fix FTBFS on
    uninitialized variable by adding null ptr checking.
    (LP: #2093295)

 -- Bryce Harrington <bryce@canonical.com>  Wed, 08 Jan 2025 15:41:11 -0800

squid (6.10-1ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2073322). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
    - d/rules: disable LTO related compilation errors for ppc64el builds.
    - d/source_squid.py, d/rules: Add apport hook (LP #676141)
  * Dropped changes:
    - d/t/upstream-test-suite: adjust autopkgtests following dpkg
      changes enabling ELF metadata. (LP #2071468)
      [ LP bug fixed in dpkg,binutils ]
    - SECURITY UPDATE: DoS in ESI processing using multi-byte characters
      + debian/patches/CVE-2024-37894.patch: fix variable datatype to handle
        variables names outside standard ASCII characters
      + CVE-2024-37894
      [ Fixed in 6.10 ]

 -- Renan Rodrigo <renanrodrigo@canonical.com>  Thu, 12 Sep 2024 16:23:16 -0300

squid (6.10-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.10
    Fixes: CVE-2024-37894. SQUID-2024:3 (Closes: #1074284)

 -- Luigi Gangitano <luigi@debian.org>  Mon,  1 Jul 2024 12:04:20 +0200

squid (6.9-1ubuntu2) oracular; urgency=medium

  * SECURITY UPDATE: DoS in ESI processing using multi-byte characters
    - debian/patches/CVE-2024-37894.patch: fix variable datatype to handle
      variables names outside standard ASCII characters
    - CVE-2024-37894  

 -- Vyom Yadav <vyom.yadav@canonical.com>  Tue, 09 Jul 2024 23:17:30 +0530

squid (6.9-1ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2064466). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
    - d/rules: disable LTO related compilation errors for ppc64el builds.
    - d/source_squid.py, d/squid-common.install: Add apport hook
      (LP #676141)
  * Dropped changes:
    - SECURITY UPDATE: DoS via chunked decoder uncontrolled recursion bug
      + debian/patches/CVE-2024-25111.patch: fix infinite recursion in
        src/http.cc, src/http.h.
      + CVE-2024-25111
      [ Fixed in 6.8 ]
  * New changes:
    - d/t/upstream-test-suite: adjust autopkgtests following dpkg
      changes enabling ELF metadata. (LP: #2071468)

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 02 Jul 2024 14:21:39 -0300

squid (6.9-1) unstable; urgency=medium

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.9

 -- Luigi Gangitano <luigi@debian.org>  Tue,  9 Apr 2024 15:04:20 +0200

squid (6.8-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.8
    Fixes: CVE-2024-25111. SQUID-2024:1

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/control
    - Migrate from pkg-config to pkgconf

 -- Luigi Gangitano <luigi@debian.org>  Mon,  4 Mar 2024 18:04:20 +0100

squid (6.6-1ubuntu5) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- William Grant <wgrant@ubuntu.com>  Mon, 01 Apr 2024 19:03:50 +1100

squid (6.6-1ubuntu4) noble; urgency=medium

  * SECURITY UPDATE: DoS via chunked decoder uncontrolled recursion bug
    - debian/patches/CVE-2024-25111.patch: fix infinite recursion in
      src/http.cc, src/http.h.
    - CVE-2024-25111

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 14 Mar 2024 10:36:04 -0400

squid (6.6-1ubuntu3) noble; urgency=medium

  * No-change rebuild against libcom-err2

 -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 12 Mar 2024 20:34:17 +0000

squid (6.6-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 21:25:34 +0000

squid (6.6-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2055179). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
    - d/rules: disable LTO related compilation errors for ppc64el builds.
    - d/source_squid.py, d/squid-common.install: Add apport hook
      (LP #676141)
  * Dropped changes:
    - SECURITY UPDATE: denial of service in HTTP request parsing
      - debian/patches/CVE-2023-50269.patch: limit x-forwarded-for hops and log
        limit as error when exceeded in src/ClientRequestContext.h,
        src/client_side_request.cc.
      - CVE-2023-50269
      [ Fixed upstream in 6.6 ]

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 27 Feb 2024 12:25:05 -0300

squid (6.6-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.6
    Fixes: CVE-2023-50269. SQUID-2023:10 (Closes: #1058721)
    Fixes: CVE-2024-23638. SQUID-2023:11

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/patches/
    - Refreshed patches

  * debian/squid-openssl.dirs
    - Stop creating empty /lib/systemd/system directory (Closes: #1058860)

  * debian/changelog
    - Fixed typo in CVE reference

 -- Luigi Gangitano <luigi@debian.org>  Thu, 18 Jan 2024 13:04:20 +0100

squid (6.5-1ubuntu3) noble; urgency=medium

  * SECURITY UPDATE: denial of service in HTTP request parsing
    - debian/patches/CVE-2023-50269.patch: limit x-forwarded-for hops and log
      limit as error when exceeded in src/ClientRequestContext.h,
      src/client_side_request.cc.
    - CVE-2023-50269

 -- Evan Caville <evan.caville@canonical.com>  Thu, 25 Jan 2024 15:41:32 +1000

squid (6.5-1ubuntu2) noble; urgency=medium

  * d/source_squid.py, d/rules: Add apport hook
    (LP: #676141)

 -- Bryce Harrington <bryce@canonical.com>  Thu, 18 Jan 2024 15:13:36 -0800

squid (6.5-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040426). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
    - d/rules: disable LTO related compilation errors for ppc64el builds.
  * Dropped changes:
    - d/t/upstream-test-suite: make missing targets for squid 6.
      [ Fixed in Debian in 6.5-1 ]
    - d/p/0011-Fix-ftp-support.patch: Fix pure virtual call in
      Ftp::Client constructor leading to problems in FTP support.
      [ Fixed upstream in 6.2 ]
    - SECURITY UPDATE: DoS against certificate validation
      + debian/patches/CVE-2023-46724.patch: fix validation of certificates
        with CN=* in src/anyp/Uri.cc.
      + CVE-2023-46724
      [ Fixed in Debian in 6.5-1 ]
    - SECURITY UPDATE: HTTP request smuggling, caused by chunked decoder
      lenience
      + debian/patches/CVE-2023-46846.patch: improve HTTP chunked encoding
        compliance in src/http/one/Parser.cc, src/http/one/Parser.h,
        src/http/one/TeChunkedParser.cc, src/parser/Tokenizer.cc,
        src/parser/Tokenizer.h.
      + CVE-2023-46846
      [ Fixed in Debian in 6.5-1 ]
    - SECURITY UPDATE: DoS via HTTP Digest Authentication
      + debian/patches/CVE-2023-46847.patch: fix stack buffer overflow when
        parsing Digest Authorization in src/auth/digest/Config.cc.
      + CVE-2023-46847
      [ Fixed in Debian in 6.5-1 ]
    - SECURITY UPDATE: DoS via ftp:// URLs
      + debian/patches/CVE-2023-46848.patch: fix userinfo percent-encoding in
        src/acl/external/eDirectory_userip/ext_edirectory_userip_acl.cc,
        src/anyp/Uri.cc.
      + CVE-2023-46848
      [ Fixed in Debian in 6.5-1 ]

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 12 Dec 2023 12:05:40 -0300

squid (6.5-1) unstable; urgency=high

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream Release 6.5
    Fixes: CVE-2023-46846. SQUID-2023:1 (Closes: #1054537)
    Fixes: CVE-2023-5824. SQUID-2023:2 (Closes: #1055249)
    Fixes: CVE-2023-46847. SQUID-2023:3 (Closes: #1055250)
    Fixes: CVE-2023-46724. SQUID-2023:4 (Closes: #1055252)
    Fixes: CVE-2023-46848. SQUID-2023:5 (Closes: #1055251)
    Fixes: CVE-2019-18860. SQUID-2023:6
    Fixes: CVE-2023-49285. SQUID-2023:7
    Fixes: CVE-2023-49286. SQUID-2023:8
    Fixes: CVE-2024-25617. SQUID-2024:2

  * Update debian/tests/upstream-test-suite for new version (Closes: #1053557)

 -- Luigi Gangitano <luigi@debian.org>  Thu,  9 Nov 2023 15:04:20 +0100

squid (6.3-1) unstable; urgency=medium

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * New Upstream version 6.3 (Closes: #1049926, #1043505)

  * debian/patches/
    - remove 0007-ftbfs-gnu-hurd.patch integrated upstream

 -- Luigi Gangitano <luigi@debian.org>  Thu, 28 Sep 2023 16:04:20 +0200

squid (6.1-2ubuntu2) noble; urgency=medium

  * SECURITY UPDATE: DoS against certificate validation
    - debian/patches/CVE-2023-46724.patch: fix validation of certificates
      with CN=* in src/anyp/Uri.cc.
    - CVE-2023-46724
  * SECURITY UPDATE: HTTP request smuggling, caused by chunked decoder
    lenience
    - debian/patches/CVE-2023-46846.patch: improve HTTP chunked encoding
      compliance in src/http/one/Parser.cc, src/http/one/Parser.h,
      src/http/one/TeChunkedParser.cc, src/parser/Tokenizer.cc,
      src/parser/Tokenizer.h.
    - CVE-2023-46846
  * SECURITY UPDATE: DoS via HTTP Digest Authentication
    - debian/patches/CVE-2023-46847.patch: fix stack buffer overflow when
      parsing Digest Authorization in src/auth/digest/Config.cc.
    - CVE-2023-46847
  * SECURITY UPDATE: DoS via ftp:// URLs
    - debian/patches/CVE-2023-46848.patch: fix userinfo percent-encoding in
      src/acl/external/eDirectory_userip/ext_edirectory_userip_acl.cc,
      src/anyp/Uri.cc.
    - CVE-2023-46848

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 13 Nov 2023 08:41:30 -0500

squid (6.1-2ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2018110). Remaining changes:
    - d/usr.sbin.squid: Add sections for squid-deb-proxy and
      squidguard
    - d/p/90-cf.data.ubuntu.patch: Add refresh patterns for deb
      packaging
    - Use snakeoil certificates:
      + d/control: add ssl-cert to dependencies
      + d/p/99-ubuntu-ssl-cert-snakeoil.patch: add a note about ssl
        to the default config file
    - d/rules, d/NEWS: drop the NIS basic auth helper (LP #1895694)
    - d/p/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch:
      Fix FTBFS due to -Werror=alloc-size-larger-than on GCC 12.
    - d/rules: halt build upon test failures.
    - d/rules: do not include additional configuration files during
      build time tests. This would lead to test failures due to missing
      paths.
    - d/t/upstream-test-suite: use installed squid binary for
      autopkgtest config file checks.
  * Drop changes:
    - d/p/fix-max-pkt-sz-for-icmpEchoData-padding.patch: Adjust
      MAX_PKT{4,6}_SZ to account for icmpEchoData padding, fixing FTBFS
      with GCC 11 (LP #1939352).
      [ Applied upstream in 6.0.1 ]
    - d/p/series: do not rely on installed binaries for build time tests.
      [ Applied in 6.1-1 ]
    - d/rules: disable LTO related compilation errors for s390x builds.
      [ Fixed in 6.1-1 ]
  * New changes:
    - d/p/0010-Fix-Werror-sign-compare-on-GCC-13.patch: fix comparison
      between signed and unsigned values.
    - d/p/0011-Fix-ftp-support.patch: Fix pure virtual call in
      Ftp::Client constructor leading to problems in FTP support.
    - d/rules: disable LTO related compilation errors for ppc64el builds.
    - d/t/upstream-test-suite: make missing targets for squid 6.

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 15 Aug 2023 21:51:44 -0300

squid (6.1-2) unstable; urgency=low

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * debian/patches/
   - add 0007-ftbfs-gnu-hurd.patch to fix GNU/Hurd build

 -- Luigi Gangitano <luigi@debian.org>  Thu, 13 Jul 2023 13:04:20 +0200

squid (6.1-1) unstable; urgency=medium

  [ Amos Jeffries <amosjeffries@squid-cache.org> ]
  * debian/{control,watch}
    - New Upstream Release

  * debian/patches/
    - refresh for new upstream version
    - add 0006-upstream-807ae4df2164defbb5f59b99282e24010b4a0b85.patch
    - remove 0003-installed-binary-for-debian-ci.patch integrated upstream
    - remove 1f13f721263a4cc75e4b798a230022561047899c.patch integrated upstream
    - remove edad3f150de8af0aeb2f629508be3219b83369b9.patch integrated upstream

  [ Luigi Gangitano <luigi@debian.org> ]
  * debian/patches/
    - add Fordwarded tag

  * debian/control
    - Bumped Standards-Version to 4.6.2, no change needed

 -- Luigi Gangitano <luigi@debian.org>  Mon, 10 Jul 2023 11:04:20 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog squid`.
