lighttpd (1.4.55-1ubuntu1.20.04.2) focal-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds Write
    - debian/patches/CVE-2022-22707.patch: mod_extforward_Forwarded function
      of the mod_extforward plugin has a stack-based buffer overflow.
      (LP: #1994989)
    - CVE-2022-22707

 -- Jack Fewx <jack@fewx.com>  Thu, 16 Feb 2023 20:09:14 -0600

lighttpd (1.4.55-1ubuntu1.20.04.1) focal; urgency=medium

  * d/control: Depend on libgamin to fix missing symbol errors (LP: #1453463)
  * d/test/control: introduce regression test for libgamin/libfam
  * d/test/libfam-libgamin-conflict-regression: check for libgamin/libfam
    conflict regressions

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 14 Jun 2021 18:34:03 -0300

lighttpd (1.4.55-1ubuntu1) focal; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - debian/control, debian/lighttpd-dev.install:
      + Add lighttpd-dev package.
    - debian/index.html:
      + Corrected BTS Ubuntu link and branding on the default page.
    - debian/lighttpd.conf:
      + Comment 'use-ipv6.pl' by default, which causes failure
        to bind port in ipv4.
    - debian/control:
      + Build-Depends on libgamin-dev rather than libfam-dev
        to fix startup warning.
    - debian/rules:
      + Add override_dh_installinit to set "defaults 91 09" to not
        start before apache2 but in the same runlevel with
        the same priority.
    - debian/lighttpd.dirs, debian/control, debian/rules,
      debian/lighttpd.ufw.profile:
      + Add the UFW profile.
    + Make the application build sanely:
      - Remove duplicate override on dh_install
      - Remove duplicate outdated NEWS file
      - Install updated upstream NEWS file and fix
        cp: cannot stat /debian/tmp/changelog thingy to
        fix FTBFS when built twice in a row.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Wed, 26 Feb 2020 14:44:09 +0100

lighttpd (1.4.55-1) unstable; urgency=medium

  [ Helmut Grohne ]
  * add debian/upstream/metadata
  * update expiration of Glenn's upstream signing key
  * move lighttpd to team maintenance
  * declare compliance with policy 4.5.0

  [ Debian Janitor ]
  * Bump debhelper from old 9 to 10.
  * Drop unnecessary dependency on dh-autoreconf.
  * Drop unnecessary dh arguments: --parallel

  [ Helmut Grohne ]
  * Drop --with systemd from dh as it is enabled by compat 10
  * New upstream version 1.4.55

  [ Glenn Strauss ]
  * add debian/conf-available/05-setenv.conf

  [ Helmut Grohne ]
  * pidfile now lives in /run/lighttpd.pid (Closes: #929203)

 -- Helmut Grohne <helmut.grohne@intenta.de>  Mon, 24 Feb 2020 14:30:34 +0100

lighttpd (1.4.54-2ubuntu1) focal; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - debian/control, debian/lighttpd-dev.install:
      + Add lighttpd-dev package.
    - debian/index.html:
      + Corrected BTS Ubuntu link and branding on the default page.
    - debian/lighttpd.conf:
      + Comment 'use-ipv6.pl' by default, which causes failure
        to bind port in ipv4.
    - debian/control:
      + Build-Depends on libgamin-dev rather than libfam-dev
        to fix startup warning.
    - debian/rules:
      + Add override_dh_installinit to set "defaults 91 09" to not
        start before apache2 but in the same runlevel with
        the same priority.
    - debian/lighttpd.dirs, debian/control, debian/rules,
      debian/lighttpd.ufw.profile:
      + Add the UFW profile.
    + Make the application build sanely:
      - Remove duplicate override on dh_install
      - Remove duplicate outdated NEWS file
      - Install updated upstream NEWS file and fix
        cp: cannot stat /debian/tmp/changelog thingy to
        fix FTBFS when built twice in a row.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 18 Feb 2020 13:55:22 +0100

lighttpd (1.4.54-2) unstable; urgency=medium

  * QA upload.
  * debian/control:
    + Bump Standards-Version to 4.4.1.
  * Rebuild with source-only upload to allow testing migration.

 -- Boyuan Yang <byang@debian.org>  Wed, 23 Oct 2019 12:34:59 -0400

lighttpd (1.4.54-1) unstable; urgency=medium

  * QA upload.
  * New upstream release.
    + Drop all patches. All applied upstream.
  * Drop transitional dummy packages after the buster release.
  * Stop recommending lighttpd-modules-*.
  * Suggest all lighttpd modules instead.
  * Install lighttpd.socket as an example.
  * Declare compliance with policy version 4.4.0.
  * Build new module package lighttpd-mod-maxminddb.

 -- Helmut Grohne <helmut.grohne@intenta.de>  Sat, 28 Sep 2019 21:38:40 +0200

lighttpd (1.4.53-4ubuntu2) eoan; urgency=medium

  * No change rebuild for libmysqlclient21.

 -- Robie Basak <robie.basak@ubuntu.com>  Wed, 21 Aug 2019 15:46:18 +0000

lighttpd (1.4.53-4ubuntu1) eoan; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - debian/control, debian/lighttpd-dev.install:
      + Add lighttpd-dev package.
    - debian/index.html:
      + Corrected BTS Ubuntu link and branding on the default page.
    - debian/lighttpd.conf:
      + Comment 'use-ipv6.pl' by default, which causes failure
        to bind port in ipv4.
    - debian/control:
      + Build-Depends on libgamin-dev rather than libfam-dev
        to fix startup warning.
    - debian/rules:
      + Add override_dh_installinit to set "defaults 91 09" to not
        start before apache2 but in the same runlevel with
        the same priority.
    - debian/lighttpd.dirs, debian/control, debian/rules,
      debian/lighttpd.ufw.profile:
      + Add the UFW profile.
    + Make the application build sanely:
      - Remove duplicate override on dh_install
      - Remove duplicate outdated NEWS file
      - Install updated upstream NEWS file and fix
        cp: cannot stat /debian/tmp/changelog thingy to
        fix FTBFS when built twice in a row.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sun, 21 Apr 2019 22:36:45 +0200

lighttpd (1.4.53-4) unstable; urgency=high

  * QA upload.
  * fix mixed use of srv->split_vals array (regression)
  * mod_magnet:fix invalid script return-type crash
  * fix assertion with server.error-handler
  * mod_wstunnel:fix wstunnel.ping-interval for big-endian architectures
  * fix abort in server.http-parseopts with url-path-2f-decode enabled
    CVE-2019-11072 (closes: #926885)

 -- Glenn Strauss <gstrauss@gluelogic.com>  Sat, 13 Apr 2019 00:00:00 -0400

# For older changelog entries, run 'apt-get changelog lighttpd'
