sssd (2.6.3-1ubuntu3.8) jammy-security; urgency=medium

  * SECURITY UPDATE: sssd_pam crash when authenticating with slow
    smartcards (LP: #2162577)
    - d/p/lp2162577-fix-use-after-free-during-p11-child-processing.patch
    - CVE-2026-12610

 -- Wesley Hershberger <wesley.hershberger@canonical.com>  Fri, 31 Jul 2026 11:52:53 -0500

sssd (2.6.3-1ubuntu3.6) jammy; urgency=medium

  * Updating apparmor profile for smartcard authentication.
    Allow access to sssd configuration directory, pcscd socket and libraries
    required for PKCS#11 module initialization. (LP: #2109673)
    - d/apparmor-profile

 -- Seyeong Kim <seyeong.kim@canonical.com>  Tue, 12 Aug 2025 04:30:46 +0000

sssd (2.6.3-1ubuntu3.5) jammy; urgency=medium

  * Fix a regression in pam_sss_gss where if KRB5CCNAME was
    not set, authentication would fail. (LP: #2103623)
    - d/p/lp2103623-pam_sss_gss-KRB5CCNAME-may-be-NULL.patch 

 -- Matthew Ruffell <matthew.ruffell@canonical.com>  Fri, 21 Mar 2025 10:11:12 +1300

sssd (2.6.3-1ubuntu3.4) jammy; urgency=medium

  * Improve PAM smartcard support for everyday scenarios such as
    removing the smartcard mid auth, by actually respecting
    require_cert_auth and improving the messaging to the user.
    (LP: #2081129)
    - d/p/lp2081129-1-pam-add-more-checks-for-require_cert_auth.patch
    - d/p/lp2081129-2-pam-better-SC-fallback-message.patch

 -- Matthew Ruffell <matthew.ruffell@canonical.com>  Mon, 16 Sep 2024 15:22:16 +1200

sssd (2.6.3-1ubuntu3.3) jammy-security; urgency=medium

  * SECURITY UPDATE: race when GPO policy is being applied
    - debian/patches/CVE-2023-3758.patch: use hash to store intermediate
      results in src/providers/ad/ad_gpo.c.
    - CVE-2023-3758

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 07 Jun 2024 10:54:47 -0400

sssd (2.6.3-1ubuntu3.2) jammy; urgency=medium

  * d/p/initialize-uid-gid-main-functions.patch: Initialize UID/GID
    variables in "main" functions, preventing inadvertent changes in
    p11_child.log file permissions. (LP: #1989356)

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Tue, 04 Oct 2022 19:04:33 -0400

sssd (2.6.3-1ubuntu3.1) jammy; urgency=medium

  * d/p/lp1934997-authentication-fails-gpo-non-existent.patch:
    Fix authentication failure when GPO is enabled and
    SecEdit/GptTmpl.inf is missing (LP: #1934997).
  * d/p/lp1979350-GPO-ignore-non-ascii-symbols-in-GPT.INI.patch:
    Ignore non-ASCII characters in GPT.INI.  (LP: #1979350)
  * Fix "sssctl analyze" (LP: #1979453)
    [ Timo Aaltonen ]
    - d/{python3-libipa-hbac.install,python3-sss.install,
      sssd-tools.install,rules}: Fix Python installation directory
      path.
    [ Sergio Durigan Junior ]
    - d/p/lp1979453-fix-shebang-on-sss_analyze.patch: Fix shebang on
      sss_analyze.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Wed, 22 Jun 2022 12:31:22 -0400

sssd (2.6.3-1ubuntu3) jammy; urgency=medium

  * No-change rebuild with new samba 4.15.5

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 24 Feb 2022 08:55:08 -0300

sssd (2.6.3-1ubuntu2) jammy; urgency=medium

  * No-change rebuild with new libnfsidmap from src:nfs-utils

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 17 Feb 2022 10:57:41 -0300

sssd (2.6.3-1ubuntu1) jammy; urgency=medium

  * Merge with Debian unstable (LP: #1946904). Remaining changes:
    - d/rules: Disable lto, not ready upstream.
    - d/control: Drop libgdm-dev Build-Depend on i386.
    - d/control: Don't build sssd-tools on i386, now uninstallable due
      to added python3-{click,systemd} dependencies.
  * Dropped changes, picked by Debian:
    - Remove RANDFILE from the config template. It's no longer necessary and
      breaks with openssl 3.0.

 -- Sergio Durigan Junior <sergio.durigan@canonical.com>  Mon, 14 Feb 2022 16:21:21 -0500

# For older changelog entries, run 'apt-get changelog libipa-hbac0'
