libapache2-mod-auth-openidc (2.4.18.1-1) unstable; urgency=medium

  * New upstream version 2.4.18.1
  * Support Rules-Requires-Root: no
  * Update d/watch file to version 5

 -- Moritz Schlarb <moschlar@debian.org>  Mon, 06 Oct 2025 12:17:40 +0200

libapache2-mod-auth-openidc (2.4.18-1) unstable; urgency=medium

  * New upstream version 2.4.18

 -- Moritz Schlarb <moschlar@debian.org>  Fri, 22 Aug 2025 11:16:03 +0200

libapache2-mod-auth-openidc (2.4.17.2-1) unstable; urgency=medium

  * New upstream version 2.4.17.2

 -- Moritz Schlarb <moschlar@debian.org>  Tue, 12 Aug 2025 09:22:44 +0200

libapache2-mod-auth-openidc (2.4.17-1) unstable; urgency=medium

  * New upstream version 2.4.17

 -- Moritz Schlarb <moschlar@debian.org>  Tue, 22 Apr 2025 11:57:49 +0200

libapache2-mod-auth-openidc (2.4.16.11-1) unstable; urgency=high

  * New upstream version 2.4.16.11
    Fixes CVE-2025-31492, Closes: #1102413

 -- Moritz Schlarb <moschlar@debian.org>  Thu, 10 Apr 2025 14:27:27 +0200

libapache2-mod-auth-openidc (2.4.16.10-1) unstable; urgency=medium

  * New upstream version 2.4.16.10
  * Modified: debian/copyright

 -- Moritz Schlarb <moschlar@debian.org>  Fri, 21 Mar 2025 13:21:41 +0100

libapache2-mod-auth-openidc (2.4.16.9-1) unstable; urgency=medium

  * New upstream version 2.4.16.9
  * Bump Standards-Version

 -- Moritz Schlarb <moschlar@debian.org>  Wed, 19 Mar 2025 14:09:33 +0100

libapache2-mod-auth-openidc (2.4.16.8-1) unstable; urgency=medium

  * New upstream version 2.4.16.8

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Mon, 17 Feb 2025 08:27:53 +0100

libapache2-mod-auth-openidc (2.4.16.7-1) unstable; urgency=medium

  * New upstream version 2.4.16.7
  * wrap-and-sort

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Thu, 13 Feb 2025 21:19:46 +0100

libapache2-mod-auth-openidc (2.4.16.6-1) unstable; urgency=medium

  * New upstream version 2.4.16.6

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Mon, 13 Jan 2025 13:44:18 +0100

libapache2-mod-auth-openidc (2.4.16.5-1) unstable; urgency=medium

  * New upstream version 2.4.16.5

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Wed, 16 Oct 2024 20:34:42 +0200

libapache2-mod-auth-openidc (2.4.16.4-1) unstable; urgency=medium

  * New upstream version 2.4.16.4

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Fri, 04 Oct 2024 10:57:37 +0200

libapache2-mod-auth-openidc (2.4.16.2-1) unstable; urgency=medium

  * New upstream version 2.4.16.2

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Fri, 30 Aug 2024 13:20:25 +0200

libapache2-mod-auth-openidc (2.4.16.1-1) unstable; urgency=medium

  * New upstream version 2.4.16.1

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Mon, 26 Aug 2024 20:46:11 +0200

libapache2-mod-auth-openidc (2.4.16-1) unstable; urgency=medium

  * New upstream version 2.4.16
    https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.16
  * Drop unnecessary patches

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Mon, 26 Aug 2024 12:50:47 +0200

libapache2-mod-auth-openidc (2.4.15.7-2) unstable; urgency=medium

  * Remove RSA PKCS v1.5 JWE algorithm (Closes: #1071319)

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Fri, 31 May 2024 13:53:12 +0200

libapache2-mod-auth-openidc (2.4.15.7-1) unstable; urgency=medium

  [ Hans Zandbelt ]
  * update to OpenIDC Github repository/organization

  [ Moritz Schlarb ]
  * Bump Standards-Version
  * New upstream version 2.4.15.7
    * CVE-2024-24814: Missing input validation on mod_auth_openidc_session_chunks
      cookie value made the server vulnerable to a Denial of Service (DoS)
      attack. If an attacker manipulated the value of the OpenIDC cookie to a
      very large integer like 99999999, the server struggled with the request for
      a long time and finally returned a 500 error. Making a few requests of this
      kind caused servers to become unresponsive, and so attackers could thereby
      craft requests that would make the server work very hard and/or crash with
      minimal effort. (Closes: #1064183)

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Thu, 18 Apr 2024 13:46:00 +0200

libapache2-mod-auth-openidc (2.4.15.1-1) unstable; urgency=medium

  * New upstream version 2.4.15.1
  * Add d/NEWS entry for 2.4.15

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Thu, 01 Feb 2024 21:28:41 +0100

libapache2-mod-auth-openidc (2.4.14.4-3) unstable; urgency=medium

  [ Hans Zandbelt ]
  * change mod to conf for auth_openidc.conf

  [ Moritz Schlarb ]
  * Add d/NEWS
  * Add zlib dependency

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Thu, 01 Feb 2024 21:14:52 +0100

libapache2-mod-auth-openidc (2.4.14.4-2) unstable; urgency=medium

  * Add d/clean (Closes: #1048824)

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Tue, 12 Dec 2023 10:50:27 +0100

libapache2-mod-auth-openidc (2.4.14.4-1) unstable; urgency=medium

  * New upstream version 2.4.14.4

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Tue, 12 Dec 2023 10:16:46 +0100

libapache2-mod-auth-openidc (2.4.14.2-1) unstable; urgency=medium

  * New upstream version 2.4.14.2
  * Refresh patches

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Fri, 30 Jun 2023 12:05:34 +0200

libapache2-mod-auth-openidc (2.4.12.3-2) unstable; urgency=high

  * Add patch to Fix CVE-2023-28625 (Closes: #1033916)
    segfault DoS when OIDCStripCookies is set
    https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Tue, 02 May 2023 11:48:09 +0200

libapache2-mod-auth-openidc (2.4.12.3-1) unstable; urgency=medium

  * New upstream version 2.4.12.3
  * Bump Standards-Version

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Thu, 16 Feb 2023 14:20:20 +0100

libapache2-mod-auth-openidc (2.4.12.2-1) unstable; urgency=medium

  * New upstream version 2.4.12.2
    Fixes CVE-2022-23527
  * Set Architecture: any (Closes: #1024978)

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Wed, 14 Dec 2022 14:58:17 +0100

libapache2-mod-auth-openidc (2.4.12.1-1) unstable; urgency=medium

  * New upstream version 2.4.12.1

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Thu, 24 Nov 2022 14:40:51 +0100

libapache2-mod-auth-openidc (2.4.12-1) unstable; urgency=medium

  * New upstream version 2.4.12

    Release 2.4.12 was (re-)certified for all OpenID Connect Relying Party
    conformance profiles using the OpenID Foundation's certification suite:
    https://openid.net/certification/#RPs.

    * Features

     * allow storing the id_token in a client-cookie based session so that it
       can be used as id_token_hint value in a logout request later;
     * allow setting connection pool parameters for Memcache server connections
     * add option to set a username for Redis >= 6.x ACL authentication via
       OIDCRedisCacheUsername
     * register request_object_signing_alg in dynamic client registration when
       using request_uri

    * Bugfixes

     * increase size of the output buffer when using libpcre2 for substitution
     * support OIDCSessionInactivityTimeout values greater than 30 days when
       using Memcache
     * allow for step-up discovery with an external URL using HTML refresh;
       fixes behaviour on CentOS 7/8 when combined with ProxyPass
     * apply exact length matching for at_hash and c_hash validation
     * store access token obtained from backchannel in session over the one
       returned in the frontchannel for code token and code id_token token flows
     * check ID token signed response algorithm on backchannel logout_token and
       retrieve its configuration value from the client metadata file

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Tue, 18 Oct 2022 09:50:00 +0200

libapache2-mod-auth-openidc (2.4.11.3-1) unstable; urgency=medium

  * New upstream version 2.4.11.3
  * Use libpcre2 instead of libpcre3 (Closes: #1000069)
  * Update debian/salsa-ci.yml file
  * Update lintian-overrides syntax
  * Update Standards-Version

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Wed, 05 Oct 2022 12:48:55 +0200

libapache2-mod-auth-openidc (2.4.11.2-1) unstable; urgency=medium

  * New upstream version 2.4.11.2

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Wed, 08 Jun 2022 12:45:43 +0200

libapache2-mod-auth-openidc (2.4.11.1-1) unstable; urgency=medium

  * New upstream version 2.4.11.1

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Thu, 31 Mar 2022 12:06:07 +0200

libapache2-mod-auth-openidc (2.4.11-1) unstable; urgency=medium

  * Set upstream metadata fields: Security-Contact.
  * New upstream version 2.4.11

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Wed, 23 Feb 2022 09:52:29 +0100

libapache2-mod-auth-openidc (2.4.10-1) unstable; urgency=medium

  * Drop patches (included upstream)
  * Update module path to built library

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Tue, 16 Nov 2021 10:13:53 +0100

libapache2-mod-auth-openidc (2.4.9.4-1) unstable; urgency=medium

  * New upstream version 2.4.9.4
  * Fix "CVE-2021-39191" (Closes: #993648)
  * 2.4.9.2 fixed a regression regarding segfault at reload/restart
    (Closes: #883616, #891224, #868949)

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Tue, 07 Sep 2021 09:37:15 +0200

libapache2-mod-auth-openidc (2.4.9-1) unstable; urgency=medium

  * New upstream version 2.4.9
  * Fix for CVE-2021-32792 (closes: #991580)
  * Fix for CVE-2021-32791 (closes: #991581)
  * Fix for CVE-2021-32786 (closes: #991582)
  * Fix for CVE-2021-32785 (closes: #991583)

 -- Christoph Martin <martin@uni-mainz.de>  Mon, 02 Aug 2021 11:45:39 +0200

libapache2-mod-auth-openidc (2.4.4.1-2) unstable; urgency=medium

  * fix CVE-2021-20718 using commit
    5ef1b0a74208fcb43a16795d0afc94c3d54cd120 from version 2.4.8 (closes:
    #989055)

 -- Christoph Martin <martin@uni-mainz.de>  Mon, 07 Jun 2021 20:54:00 +0200

libapache2-mod-auth-openidc (2.4.4.1-1) unstable; urgency=medium

  [ Debian Janitor ]
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
    Repository-Browse.

  [ Moritz Schlarb ]
  * Move upstream URLs to new name
  * New upstream version 2.4.4.1
  * Bump dh-compat
  * Fix d/copyright
  * Remove removed lintian override
    apache2-module-depends-on-real-apache2-package

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Thu, 12 Nov 2020 09:25:40 +0100

libapache2-mod-auth-openidc (2.4.3-1) unstable; urgency=medium

  * New upstream version 2.4.3

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Thu, 18 Jun 2020 12:54:41 +0200

libapache2-mod-auth-openidc (2.4.1-1) unstable; urgency=medium

  * New upstream version 2.4.1
  * Bump Standards-Version and use declarative debhelper

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Thu, 13 Feb 2020 12:07:30 +0100

libapache2-mod-auth-openidc (2.4.0.4-1) unstable; urgency=medium

  * New upstream version 2.4.0.4
  * Update Standards-Version

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Tue, 12 Nov 2019 10:45:51 +0100

libapache2-mod-auth-openidc (2.4.0.3-1) unstable; urgency=high

  * Update watch file to use Github tag archives
  * New upstream version 2.4.0.3
    (Closes: #942165)

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Wed, 16 Oct 2019 10:13:44 +0200

libapache2-mod-auth-openidc (2.4.0-1) unstable; urgency=medium

  * New upstream version 2.4.0
  * Refresh patch

 -- Moritz Schlarb <schlarbm@uni-mainz.de>  Mon, 16 Sep 2019 14:50:28 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libapache2-mod-auth-openidc`.
