wget (1.21.2-2ubuntu1.5) jammy-security; urgency=medium

  * SECURITY REGRESSION: Incomplete fix for CVE-2026-58472 (LP: #2163754)
    - debian/patches/CVE-2026-58472-post1.patch: Fix buffer overflow in
      src/convert.c

 -- Kyle Kernick <kyle.kernick@canonical.com>  Wed, 19 Aug 2026 18:01:10 -0600

wget (1.21.2-2ubuntu1.4) jammy-security; urgency=medium

  * SECURITY UPDATE: SSRF forgery in FTP.
    - debian/patches/CVE-2026-15146.patch: Validate PASV/LPSV response address
      against control connection peer in src/ftp-basic.c
    - CVE-2026-15146

 -- Kyle Kernick <kyle.kernick@canonical.com>  Thu, 16 Jul 2026 10:38:47 -0600

wget (1.21.2-2ubuntu1.3) jammy-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow in metalink.
    - debian/patches/CVE-2026-58469.patch: Fix buffer overflow in
      src/metalink.c
    - CVE-2026-58469
  * SECURITY UPDATE: Integer overflow in http
    - debian/patches/CVE-2026-58470.patch: Fix integer overflow in src/http.c
    - CVE-2026-58470
  * SECURITY UPDATE: Buffer overflow in convert_fname.
    - debian/patches/CVE-2026-58471.patch: Fix buffer overflow in src/url.c
    - CVE-2026-58471
  * SECURITY UPDATE: Integer and buffer overflow in html_quote_string.
    - debian/patches/CVE-2026-58472.patch: Fix integer+buffer overflow in
      src/convert.c
    - CVE-2026-58472

 -- Kyle Kernick <kyle.kernick@canonical.com>  Fri, 10 Jul 2026 16:04:53 -0600

wget (1.21.2-2ubuntu1.1) jammy-security; urgency=medium

  * SECURITY UPDATE: mishandling of semicolons in userinfo
    - debian/patches/CVE-2024-38428.patch: properly re-implement userinfo
      parsing in src/url.c.
    - CVE-2024-38428

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 19 Jun 2024 08:15:59 -0400

wget (1.21.2-2ubuntu1) jammy; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Don't Build-Depend on libgnutls28-dev, only on libssl-dev.
    - Pass --with-ssl=openssl

 -- Lukas Märdian <slyon@ubuntu.com>  Mon, 24 Jan 2022 12:59:00 +0100

wget (1.21.2-2) unstable; urgency=medium

  * cherry pick to fix SSL_INIT output wget#61125 closes: Bug#996174

 -- Noël Köthe <noel@debian.org>  Wed, 13 Oct 2021 16:35:25 +0200

wget (1.21.2-1) unstable; urgency=medium

  * new upstream release from 2021-09-07

 -- Noël Köthe <noel@debian.org>  Sun, 10 Oct 2021 16:31:17 +0200

wget (1.21-1ubuntu5) jammy; urgency=medium

  * No-change rebuild against openssl3

 -- Simon Chopin <simon.chopin@canonical.com>  Wed, 24 Nov 2021 13:58:06 +0000

wget (1.21-1ubuntu4) impish; urgency=medium

  * No-change rebuild to build packages with zstd compression.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Oct 2021 12:26:23 +0200

wget (1.21-1ubuntu3) hirsute; urgency=medium

  * Rebuild again so s390x picks up the right debhelper

 -- Sebastien Bacher <seb128@ubuntu.com>  Wed, 24 Feb 2021 16:32:45 +0100

# For older changelog entries, run 'apt-get changelog wget'
