knot-resolver (3.2.1-3ubuntu2.2) focal-security; urgency=medium

  * SECURITY UPDATE: improper input validation when handling DNSSEC validation
    - debian/patches/CVE-2019-10190.patch: send EDNS with SERVFAILs when
      handling DNSSEC validation failures in lib/layer/iterate.c,
      lib/resolve.*, modules/cookies/cookiemonster.c, modules/hints/hints.c.
    - CVE-2019-10190
  * SECURITY UPDATE: poison cache via unsigned negative answer
    - debian/patches/CVE-2019-10191.patch: Don't stash a packet with a
      mismatching QNAME+QTYPE in daemon/lua/kres-gen.lua, daemon/worker.c,
      lib/cache/api.c, lib/cache/impl.h, lib/layer.h, lib/layer/iterate.c,
      lib/resolve.c, lib/rplan.h.
    - CVE-2019-10191
  * SECURITY UPDATE: denial of service via high CPU utilisation when
    processing some DNS packets
    - debian/patches/CVE-2019-19331_1_of_3.patch: improve performance when
      handling large RRsets in daemon/lua/kres-gen.*, lib/cache/api.c,
      lib/dnssec.c, lib/layer/iterate.c, lib/resolve.c, lib/utils.*.
    - debian/patches/CVE-2019-19331_2_of_3.patch: reduce CNAME chain length 
      limit in daemon/lua/kres-gen.lua, lib/layer/iterate.c, lib/rplan.h.
    - debian/patches/CVE-2019-19331_3_of_3.patch: ENOMEM -> abort() in 
      lib/utils.c.
    - CVE-2019-19331
  * SECURITY UPDATE: traffic amplification via a crafted DNS answer from an 
    attacker-controlled server
    - debian/patches/CVE-2020-12667_1_of_2.patch: limit number of failed NS 
      name resolution attempts for each request in daemon/lua/kres-gen.lua, 
      lib/defines.h, lib/resolve.*.
    - debian/patches/CVE-2020-12667_2_of_2.patch: limit number of consecutive
      failures and kill whole request if limit is exceeded in 
      daemon/lua/kres-gen.lua, lib/defines.h, lib/layer/iterate.c, 
      lib/resolve.*.
    - CVE-2020-12667

 -- Evan Caville <evan.caville@canonical.com>  Wed, 25 Sep 2024 11:03:16 +1000

knot-resolver (3.2.1-3ubuntu2.1) focal-security; urgency=medium

  * SECURITY UPDATE: denial of service issue when server returns large ns or
    address sets
    - debian/patches/CVE-2022-40188.patch: address throttling introduced for
      large responses.
    - CVE-2022-40188

 -- Evan Caville <evan.caville@canonical.com>  Mon, 26 Jun 2023 11:44:34 +1000

knot-resolver (3.2.1-3ubuntu2) focal; urgency=medium

  * d/p/lp1861924-daemon-trust_anchors.test-Turn-off-expiration-date-i.patch:
    - update test certs that had expired (LP: #1861924)
  * d/t/control:
    - remove datefudge hack since above fixes this properly

 -- Dan Streetman <ddstreet@canonical.com>  Tue, 04 Feb 2020 15:33:45 -0500

knot-resolver (3.2.1-3ubuntu1) focal; urgency=medium

  * Use datefudge to back into 2019 and make tests pass. The certs have
    3rd of January 2020 as a threshold point for expired/not-valid/etc
    tests. This is fixed upstream, but patch from master doesn't make the
    tests pass in this version. Hence datefudge it instead.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 14 Jan 2020 16:39:58 +0000

knot-resolver (3.2.1-3) unstable; urgency=medium

  * knot-resolver-module-http is arch: all, not arch: any
  * Explicitly list all non-arm64 architectures

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Fri, 08 Mar 2019 00:56:09 -0500

knot-resolver (3.2.1-2) unstable; urgency=medium

  * Standards-Version: move to 4.3.0 (no changes needed)
  * move to debhelper 12
  * Avoid breakage when built against knot-dns 2.8.0
  * d/tests/control: wrap-and-sort
  * Drop libkres9 and libkres-dev packages (Closes: #923970)
  * avoid clobbering CXXFLAGS when compiling lua-aho-corasick
  * missing-sources: updated dygraph-combined.js to match minified version
  * avoid shipping pre-built glyphicons-halflings-regular.woff2

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Thu, 07 Mar 2019 16:23:16 -0500

knot-resolver (3.2.1-1) unstable; urgency=medium

  * new upstream release (Closes: #922172)
  * Update symbols file for 3.2.1 release

 -- Ondřej Surý <ondrej@debian.org>  Thu, 21 Feb 2019 09:42:37 +0000

knot-resolver (3.2.0-1) unstable; urgency=medium

  * new upstream release
  * bump ABI from libkres8 to libkres9
  * drop reproducibility patch, adopted upstream
  * include experimental_dot_auth module (recommend: lua-basexx for it)
  * d/copyright: removed reference to ISAAC, removed upstream

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 19 Dec 2018 19:23:37 -0500

knot-resolver (3.1.0-1) unstable; urgency=medium

  * new upstream release
  * set knot-resolver-doc to Multi-Arch: foreign
  * drop upstreamed patch; avoid use of git during installcheck
  * make reproducible datestamp in kresd(8)
  * increase build-dep on libknot to 2.7.2
  * updated libkres8.symbols
  * minimize upstream signing keys
  * drop unused lintian-overrides

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Tue, 20 Nov 2018 15:47:19 -0500

knot-resolver (3.0.0-9) unstable; urgency=medium

  * autopkg: allow stderr on "make installcheck"

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 12 Sep 2018 13:02:45 -0400

# For older changelog entries, run 'apt-get changelog knot-resolver-module-http'
