unbound (1.24.2-1ubuntu2.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Packet of death with DNSCrypt (feasibility very low)
    - debian/patches/CVE-2026-32792: validate len in dnscrypt/dnscrypt.c.
    - CVE-2026-32792
  * SECURITY UPDATE: Possible remote code execution during DNSSEC validation
    - debian/patches/CVE-2026-33278.patch: save rrsets alloc by gen_dns_msg
      in services/cache/dns.c, testdata/*, validator/val_nsec3.c.
    - CVE-2026-33278
  * SECURITY UPDATE: "Ghost domain name" variant
    - debian/patches/CVE-2026-40622.patch: never let an NS overwrite extend
      lifetime past the entry it replaces in services/cache/rrset.c.
    - CVE-2026-40622
  * SECURITY UPDATE: Parsing a long list of incoming EDNS options degrades
    performance
    - debian/patches/CVE-2026-41292.patch: limit parsed edns options in
      util/data/msgparse.c.
    - CVE-2026-41292
  * SECURITY UPDATE: Jostle logic bypass degrades resolution performance
    - debian/patches/CVE-2026-42534.patch: properly handle jostle aging in
      services/mesh.c, services/mesh.h.
    - CVE-2026-42534
  * SECURITY UPDATE: Degradation of service with unbounded NSEC3 hash
    calculations
    - debian/patches/CVE-2026-42923.patch: limit salt length in
      validator/val_neg.c, validator/val_nsec3.c, validator/val_nsec3.h.
    - CVE-2026-42923
  * SECURITY UPDATE: Heap overflow and crash with multiple nsid, cookie,
    padding EDNS options
    - debian/patches/CVE-2026-42944.patch: use proper data sizes in
      testcode/unitmain.c, util/data/msgencode.c, util/data/msgencode.h,
      util/data/msgparse.c.
    - CVE-2026-42944
  * SECURITY UPDATE: Crash during DNSSEC validation of malicious content
    - debian/patches/CVE-2026-42959.patch: fix calculations in
      validator/val_utils.c.
    - CVE-2026-42959
  * SECURITY UPDATE: Possible cache poisoning attack while following
    delegation
    - debian/patches/CVE-2026-42960.patch: only mark glue as allowed for
      type NS in the authority section in iterator/iter_scrub.c.
    - CVE-2026-42960
  * SECURITY UPDATE: Unbounded name compression in certain cases causes
    degradation of service
    - debian/patches/CVE-2026-44390.patch: fix counting in
      util/data/msgencode.c.
    - CVE-2026-44390
  * SECURITY UPDATE: Use after free and crash in RPZ code
    - debian/patches/CVE-2026-44608.patch: fix UaF in services/rpz.c.
    - CVE-2026-44608

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 18 May 2026 18:32:13 -0400

unbound (1.24.2-1ubuntu2) resolute; urgency=medium

  * No-change rebuild with Python 3.14 as default

 -- Graham Inggs <ginggs@ubuntu.com>  Fri, 23 Jan 2026 15:02:18 +0000

unbound (1.24.2-1ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2126008). Remaining changes:
    - Don't build with hiredis on i386.  hiredis and redis are not built
      on i386 and require bootstrapping due to circular
      build-dependencies; simpler to just disable this in the i386
      unbound server binary (that no one will ever use).
  * Dropped changes:
    - d/p/CVE-2025-11411 [included in 1.23.1-1]
    - d/p/Fix-RebirthDay-Attack-CVE-2025-5994 [included in 1.23.1-1]
    - d/p/fix_ftbfs_function [replaced by
      d/p/replace-deprecated-function-by-new-action in 1.24.1-2]

 -- Jonas Jelten <jonas.jelten@canonical.com>  Tue, 02 Dec 2025 17:05:25 +0100

unbound (1.24.2-1) unstable; urgency=medium

  * new upstream security release:
    Additional fix for CVE-2025-11411 (possible domain hijacking attack),
    to include YXDOMAIN and non-referral nodata answers in the mitigation
    as well, reported by TaoFei Guo from Peking University, Yang Luo
    and JianJun Chen from Tsinghua University.
    Closes: #1121446, CVE-2025-11411
  * debian/upstream/signing-key.asc: merge two separate parts into one
    (keeping the same two keys)

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 26 Nov 2025 22:59:06 +0300

unbound (1.24.1-2) unstable; urgency=medium

  * replace-deprecated-function-by-new-action.patch:
    fix build with new SWIG 4.4.0 (fix from upstream)

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 30 Oct 2025 14:18:08 +0300

unbound (1.24.1-1) unstable; urgency=medium

  [ MichaIng ]
  * d/unbound.conf.d/remote-control.conf: fix typo

  [ Michael Tokarev ]
  * d/upstream/signing-key.asc: add Yorgos Thessalonikefs key
    (CFF3 344D 9087 A490)
  * new upstream security/bugfix release
    Closes: CVE-2025-11411 (possible domain hijacking attack)

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 22 Oct 2025 13:41:36 +0300

unbound (1.24.0-2) unstable; urgency=medium

  * d/tests/runzones: set so-sndbuf to 0
    unbound tries to set it to a large(ish) value which is not allowed
    for a non-root.  And unbound complains to stderr, causing test failure.

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 23 Sep 2025 17:40:14 +0300

unbound (1.24.0-1) unstable; urgency=medium

  * new upstream release
  * d/rules,d/libunbound-dev.install: drop static library and deps
    (Closes: #1096189)

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 18 Sep 2025 20:55:14 +0300

unbound (1.23.1-1) unstable; urgency=medium

  * new upstream release
  * d/apparmor-profile: remove sssd path which is in apparmor base
    for a very long time
  * Fix-RebirthDay-Attack-CVE-2025-5994.patch: remove

 -- Michael Tokarev <mjt@tls.msk.ru>  Sun, 24 Aug 2025 12:37:28 +0300

unbound (1.22.0-2ubuntu4) resolute; urgency=medium

  * debian/patches/fix_ftbfs_function.patch: replace deprecated $function
    by new $action.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 04 Nov 2025 16:27:33 +0100

unbound (1.22.0-2ubuntu3) resolute; urgency=medium

  * SECURITY UPDATE: promiscuous NS RRSets domain hijack issue
    - debian/patches/CVE-2025-11411.patch: fix possible domain hijacking
      attack and add new iter-scrub-promiscuous configuration option.
    - CVE-2025-11411

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 31 Oct 2025 08:47:51 -0400

unbound (1.22.0-2ubuntu2) questing; urgency=medium

  * Rebuild to include updated RISC-V base ISA RVA23

 -- Heinrich Schuchardt <heinrich.schuchardt@canonical.com>  Sat, 06 Sep 2025 15:37:34 +0000

unbound (1.22.0-2ubuntu1) questing; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Don't build with hiredis on i386.  hiredis and redis are not built
      on i386 and require bootstrapping due to circular
      build-dependencies; simpler to just disable this in the i386
      unbound server binary (that no one will ever use).

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 22 Jul 2025 08:58:36 -0400

unbound (1.22.0-2) unstable; urgency=medium

  * add Fix-RebirthDay-Attack-CVE-2025-5994.patch from upstream
    (Closes: #1109427, CVE-2025-5994)

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 17 Jul 2025 19:05:22 +0300

unbound (1.22.0-1ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2087526, LP: #2085302). Remaining changes:
    - Don't build with hiredis on i386.  hiredis and redis are not built
      on i386 and require bootstrapping due to circular
      build-dependencies; simpler to just disable this in the i386
      unbound server binary (that no one will ever use).
  * Dropped:
    - SECURITY UPDATE: null pointer dereference
      + debian/patches/CVE-2024-43167-1.patch: fix null pointer
        dereference issue in function ub_ctx_set_fwd of file
        libunbound/libunbound.c
      + debian/patches/CVE-2024-43167-2.patch: fix to print a parse
        error when config is read with no name for a forward-zone, stub-
        zone or view.
      + CVE-2024-43167
        [Fixed upstream]
    - SECURITY UPDATE: denial of service via large RRsets compression
      + debian/patches/CVE-2024-8508.patch: limit name compression
        calculations per packet to avoid CPU lockup in util/data/msgencode.c
      + CVE-2024-8508
        [Fixed upstream]

 -- Andreas Hasenack <andreas@canonical.com>  Tue, 28 Jan 2025 18:44:57 -0300

unbound (1.22.0-1) unstable; urgency=medium

  * new upstream release (1.22.0)

 -- Michael Tokarev <mjt@tls.msk.ru>  Sat, 19 Oct 2024 13:11:14 +0300

unbound (1.21.1-1) unstable; urgency=medium

  * new upstream release 1.21.1
    Closes: #1078647, CVE-2024-43167 (NULL ptr deref in ub_ctx_set_fwd)
    Closes: #1083282, CVE-2024-8508 (Unbounded name compression)

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 04 Oct 2024 17:48:04 +0300

unbound (1.20.0-1ubuntu2.2) plucky; urgency=medium

  * No-change rebuild for Python 3.13 as the default.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 03 Jan 2025 12:01:59 +0100

unbound (1.20.0-1ubuntu2.1) oracular-security; urgency=medium

  * SECURITY UPDATE: denial of service via large RRsets compression
    - debian/patches/CVE-2024-8508.patch: limit name compression
      calculations per packet to avoid CPU lockup in util/data/msgencode.c
    - CVE-2024-8508

 -- Vyom Yadav <vyom.yadav@canonical.com>  Thu, 17 Oct 2024 11:09:49 +0530

unbound (1.20.0-1ubuntu2) oracular; urgency=medium

  * SECURITY UPDATE: null pointer dereference
    - debian/patches/CVE-2024-43167-1.patch: fix null pointer
      dereference issue in function ub_ctx_set_fwd of file
      libunbound/libunbound.c
    - debian/patches/CVE-2024-43167-2.patch: fix to print a parse
      error when config is read with no name for a forward-zone, stub-
      zone or view.
    - CVE-2024-43167

 -- Bruce Cable <bruce.cable@canonical.com>  Mon, 09 Sep 2024 10:48:56 +1000

unbound (1.20.0-1ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2064475). Remaining changes:
    - Don't build with hiredis on i386.  hiredis and redis are not built
      on i386 and require bootstrapping due to circular
      build-dependencies; simpler to just disable this in the i386
      unbound server binary (that no one will ever use).

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 12 Aug 2024 15:41:36 -0300

unbound (1.20.0-1) unstable; urgency=medium

  * new upstream release with some new features and many bugfixes
    Closes: CVE-2024-33655 (DNSBomb issue)
  * remove do-not-look-at-pidfile.patch now once upstream
    stopped chowning the pidfile
  * +spelling-overriden.patch
  * d/rules: enable -j in MAKEFLAGS when parallel is in DEB_BUILD_OPTIONS
  * d/control: Standards-Version: 4.6.0=>4.6.2

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 09 May 2024 14:47:04 +0300

unbound (1.19.2-1ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 08:30:00 +0000

unbound (1.19.2-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libevent-2.1-7t64

 -- Simon Chopin <schopin@ubuntu.com>  Fri, 29 Mar 2024 17:26:09 +0100

unbound (1.19.2-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2056552). Remaining changes:
    - Don't build with hiredis on i386.  hiredis and redis are not built
      on i386 and require bootstrapping due to circular
      build-dependencies; simpler to just disable this in the i386
      unbound server binary (that no one will ever use).

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 08 Mar 2024 10:23:53 -0300

unbound (1.19.2-1) unstable; urgency=medium

  * new upstream bugfix release. Closes: CVE-2024-1931,
    denial of service when trimming EDE text on positive replies
  * d/changelog: add the forgotten Closes for
    #1063845, #1051817, #1051818, #1056631 to the previous
    changelog entry

 -- Michael Tokarev <mjt@tls.msk.ru>  Thu, 07 Mar 2024 23:35:52 +0300

unbound (1.19.1-1ubuntu3) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 05 Mar 2024 02:09:01 +0000

unbound (1.19.1-1ubuntu2) noble; urgency=medium

  * No-change rebuild for python3.12 t64.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 02 Mar 2024 21:15:53 +0100

unbound (1.19.1-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2055042). Remaining changes:
    - Don't build with hiredis on i386.  hiredis and redis are not built
      on i386 and require bootstrapping due to circular
      build-dependencies; simpler to just disable this in the i386
      unbound server binary (that no one will ever use).

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 26 Feb 2024 10:03:33 -0300

unbound (1.19.1-1) unstable; urgency=medium

  * new upstream bugfix release (1.19.1) (Closes: #1063845):
   o Fix CVE-2023-50387, DNSSEC verification complexity can be exploited
     to exhaust CPU resources and stall DNS resolvers
   o Fix CVE-2023-50868, NSEC3 closest encloser proof can exhaust CPU
  * new upstream release (1.19.0) (Closes: #1051817, #1051818, #1056631)
  * d/control: Build-Depends: pkg-config => pkgconf
  * d/unbound.lintian-overrides: remove
    package-supports-alternative-init-but-no-init.d-script
  * d/unbound.lintian-overrides: adjust for /lib=>/usr/lib move

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 13 Feb 2024 22:40:40 +0300

unbound (1.18.0-2ubuntu2) noble; urgency=medium

  * No-change rebuild with Python 3.12 as default

 -- Graham Inggs <ginggs@ubuntu.com>  Fri, 19 Jan 2024 21:03:32 +0000

unbound (1.18.0-2ubuntu1) noble; urgency=medium

  * Don't build with hiredis on i386.  hiredis and redis are not built on
    i386 and require bootstrapping due to circular build-dependencies;
    simpler to just disable this in the i386 unbound server binary (that no
    one will ever use).

 -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 24 Nov 2023 10:36:50 -0800

unbound (1.18.0-2) unstable; urgency=medium

   * d/resolvconf-forwards: remove -e (Closes: #1035800), shorten sed expr
   * d/changelog: mention #1013957 in previous changelog entry
   * d/control, d/rules: switch from libnettle back to libssl once it is
     GPL-compatible (#828699 is of no concern anymore).  This fixes libunbound
     init failure.  Also Closes: #1007260
   * d/control, d/rules: build daemon with --enable-cachedb --with-libhiredis,
     build-depend on libhiredis-dev (Closes: #1014456)

 -- Michael Tokarev <mjt@tls.msk.ru>  Wed, 06 Sep 2023 16:34:32 +0300

unbound (1.18.0-1) unstable; urgency=medium

  * new upstream release
    Closes: #1038243
  * d/copyright: relicense debian/patches/* under ISC license
    (Closes: #1013957)

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 04 Sep 2023 09:41:58 +0300

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libunbound8`.
