gnupg2 (2.2.4-1ubuntu1.6) bionic-security; urgency=medium

  * SECURITY UPDATE: signature forgery via injection into the status line
    - debian/patches/CVE-2022-34903.patch: Fix garbled status messages in
      NOTATION_DATA in g10/cpr.c.
    - CVE-2022-34903

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 04 Jul 2022 12:20:59 -0400

gnupg2 (2.2.4-1ubuntu1.5) bionic-security; urgency=medium

  * SECURITY UPDATE: Certificate Spamming Attack through SKS
    (LP: #1844059)
    - debian/patches/CVE-2019-13050-1.patch: add option to only accept
      self-signatures when importing a key in g10/import.c,
      g10/options.h and doc/gpg.texi.
    - debian/patches/CVE-2019-13050-2.patch: add fallback when importing
      self-signatures only in g10/import.c.
    - debian/patches/CVE-2019-13050-3.patch: add "self-sigs-only" and 
      "import-clean" to the keyserver options in g10/gpg.c and 
      doc/gpg.texi.
    - debian/patches/CVE-2019-13050-4.patch: fix regression by ensuring
      KEYID is available on a pending package in g10/import.c.
    - debian/patches/CVE-2019-13050-5.patch: prevent fallback from being
      used if the options are already used in g10/import.c.
    - CVE-2019-13050

 -- David Fernandez Gonzalez <david.fernandezgonzalez@canonical.com>  Thu, 26 May 2022 12:24:46 +0200

gnupg2 (2.2.4-1ubuntu1.4) bionic; urgency=medium

  * d/p/dirmngr-handle-EAFNOSUPPORT-at-connect_server.patch:
    - Fix IPv6 connectivity for dirmngr (LP: #1910432)
  * Fix autopkgtests (LP: #1825186)
    - add d/t/simple-tests from devel branch
    - remove broken gpgv-win32 test from d/t/control

 -- Heitor Alves de Siqueira <halves@canonical.com>  Sat, 16 Jan 2021 14:47:37 +0000

gnupg2 (2.2.4-1ubuntu1.3) bionic-security; urgency=medium

  * SECURITY UPDATE: signature collisions via insecure SHA-1 algorithm
    - debian/patches/CVE-2019-14855-1.patch: reject certain SHA-1 based
      signatures in g10/sig-check.c.
    - debian/patches/CVE-2019-14855-2.patch: add new option
      --allow-weak-key-signatures in doc/gpg.texi, g10/gpg.c, g10/main.h,
      g10/misc.c, g10/options.h, g10/sig-check.c.
    - debian/patches/CVE-2019-14855-3.patch: forbid the creation of SHA-1
      third-party key signatures in g10/sign.c.
    - debian/patches/CVE-2019-14855-4.patch: adjust tests for now invalid
      SHA-1 key signatures in tests/openpgp/defs.scm.
    - CVE-2019-14855

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 17 Sep 2020 09:57:57 -0400

gnupg2 (2.2.4-1ubuntu1.2) bionic-security; urgency=medium

  * SECURITY UPDATE: CSRF in dirmngr
    - debian/patches/CVE-2018-1000858.patch: don't follow a redirect in
      dirmngr/Makefile.am, dirmngr/http.c, dirmngr/http.h,
      dirmngr/ks-engine-hkp.c, dirmngr/ks-engine-http.c,
      dirmngr/t-http-basic.c, dirmngr/t-http.c.
    - CVE-2018-1000858

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 10 Jan 2019 08:07:03 -0500

gnupg2 (2.2.4-1ubuntu1.1) bionic-security; urgency=medium

  * SECURITY UPDATE: missing sanitization of verbose output
    - debian/patches/from-master/CVE-2018-12020.patch: Sanitize diagnostic with
      the original file name.
    - CVE-2018-12020
  * SECURITY UPDATE: certify public keys without a certify key present
    when using a smartcard.
    - debian/patches/from-master/CVE-2018-9234-1.patch,
    - debian/patches/from-master/CVE-2018-9234-2.patch: Check that a key
      may do certifications.
    - CVE-2018-9234
  * Always use MDC encryption mode regardless of the cipher algorithm
    or any preferences. The --rfc2440 option can be used to create
    a message without an MDC.
    - debian/patches/from-master/0003-gpg-Remove-MDC-options.patch
  * Decryption of messages not using the MDC mode into a hard
    failure even if a legacy cipher algorithm was used.  The
    option --ignore-mdc-error can be used to turn this failure
    into a warning.
    - debian/patches/from-master/0001-gpg-Turn-no-mdc-warn-into-a-NOP.patch
    - debian/patches/from-master/0003-gpg-Remove-MDC-options.patch
    - debian/patches/from-master/0004-gpg-Print-a-hint-on-how-to-decrypt-a-non-mdc-message.patch

 -- Steve Beattie <sbeattie@ubuntu.com>  Sun, 10 Jun 2018 21:54:05 -0700

gnupg2 (2.2.4-1ubuntu1) bionic; urgency=medium

  * Merge from Debian unstable, remaining changes:
    - debian/gnupg2.udev:
      - Add udev rules to give gpg access to some smartcard readers;
        Debian #543217.
      - udev rules to set ACLs on SCM smartcard readers.
    - Add breaks for software-properties-common at 0.96.24.3 or lower.
    - Honor http_proxy= environment variables by default in the systemd
      user session dirmngr service. LP: #1625848
    - Export GPG_AGENT_INFO in the systemd-environment-generator too.

  * Dropped changes:
    - Removed user session upstart support.
    - Removed gpg-agent.service changes, use Debian's environment generator instead.
    - Patch to set GNUPGHOME for tests, fixed in debian/upstream.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 11 Jan 2018 13:33:17 +0000

gnupg2 (2.2.4-1) unstable; urgency=medium

  * New upstream release
  * do not use uupdate (we use gbp-import-orig)
  * dirmngr: cannot avoid idling in current arrangement
  * adjusting fixes to gpgsm defaults
  * prefer SHA-512 specifically on personal-digest-preferences.
  * refresh patches
  * Standards-Version: bump to 4.1.3 (no changes needed)
  * drop unnecessary lintian override
  * reflect actual requirement for libassuan
  * import bugfixes from upstream

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 03 Jan 2018 12:43:40 -0500

gnupg2 (2.2.3-1) unstable; urgency=medium

  * New upstream release
  * refreshed patches

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Thu, 30 Nov 2017 19:06:35 -0500

gnupg2 (2.2.2-1) unstable; urgency=medium

  * new upstream release.
  * avoid testsuite delays from excess socket waiting
  * clean up trailing whitespace in debian/{rules,changelog}
  * drop patches already upstream
  * refresh remaining patches

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 08 Nov 2017 20:09:33 +0100

# For older changelog entries, run 'apt-get changelog gpgv-static'
