libpam-krb5 (4.7-2ubuntu0.1) xenial-security; urgency=medium

  * SECURITY UPDATE: One-byte buffer overflow
    - debian/patches/CVE-2020-10595.patch: checks prompts[i].reply->length
      boundaries in prompting.c.
    - CVE-2020-10595

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Tue, 24 Mar 2020 09:22:14 -0300

libpam-krb5 (4.7-2) unstable; urgency=medium

  * Upload to unstable.
  * Refresh upstream signing key.
  * Add debian/gbp.conf reflecting the branch layout of the default
    packaging repository.

 -- Russ Allbery <rra@debian.org>  Sun, 26 Apr 2015 20:23:59 -0700

libpam-krb5 (4.7-1) experimental; urgency=medium

  * Upload to experimental due to release freeze.
  * New upstream release.
    - Add no_update_user option to disable the normal update of PAM_USER
      after user canonicalization.
    - Suppress spurious Heimdal password prompt when using PKINIT.
    - Map unknown realm errors to PAM_AUTHINFO_UNAVAIL.
    - Treat more error codes as incorrect passwords for better
      compatibility between MIT client libraries and Heimdal KDCs.
    - Add version number when module options were added to the man page.
  * Remove erroneous branch information from Vcs-Git.
  * Fix debian/copyright to match the correct upstream licensing.
  * Update standards version to 3.9.6 (no changes required).

 -- Russ Allbery <rra@debian.org>  Thu, 25 Dec 2014 19:36:00 -0800

libpam-krb5 (4.6-3) unstable; urgency=medium

  * Drop version qualifications on Build-Depends that are satisfied by
    stable.  Drop version qualifications on Depends that are satisfied by
    oldstable.
  * Add the upstream release signing key and verify it in debian/watch.
  * Prefer *.tar.xz in debian/watch to match packaging.
  * Convert debian/copyright to copyright-format 1.0.
  * Specify the Debian packaging branch in the Vcs-Git control field.
  * Update standards version to 3.9.5 (no changes required).

 -- Russ Allbery <rra@debian.org>  Sun, 13 Apr 2014 13:13:38 -0700

libpam-krb5 (4.6-2) unstable; urgency=low

  * Apply upstream patch to add AM_PROG_AR to configure.ac, now apparently
    required by Automake for the binutils in unstable.  (Closes: #713296)
  * Apply upstream patch to build with largefile support.  This is
    probably pointless for this module, but consistency is good.
  * Canonicalize the Vcs-Git and Vcs-Browser URLs.
  * Update standards version to 3.9.4 (no changes required).

 -- Russ Allbery <rra@debian.org>  Sun, 23 Jun 2013 12:33:04 -0700

libpam-krb5 (4.6-1) unstable; urgency=low

  * New upstream release.
    - New anon_fast option to attempt anonymous authentication and use
      those credentials to provide FAST armor.  (Closes: #626509)
    - New user_realm option to set the realm for unqualified user
      principals without changing the default realm for all other
      operations.
    - New no_prompt option to suppress PAM prompting in favor of letting
      the Kerberos library handle it.  (Closes: #626506)
    - New silent option that duplicates the behavior of PAM_SILENT.
    - New trace option for preliminary support of Kerberos trace logging.
    - Fix the doubled colon in password prompts from Heimdal.
    - Preserve the realm of the authentication identity when forming an
      alt_auth_map identity.
    - Allow the alt_auth_map format to contain a realm to force all mapped
      principals to be in that realm.
    - Avoid a NULL pointer dereference if krb5_init_context fails.
      (LP: #998525)
    - Close memory leaks in search_k5login and alt_auth_map.
    - Suppress bogus error messages about the realm option.
    - Retry authentication under try_first_pass for several other error
      conditions.
  * Regenerate the Autotools build system with dh-autoreconf.
  * Add krb5-config to Build-Depends so that the test programs don't abort
    with errors about not having a Kerberos configuration.
  * Switch to xz compression for the upstream and Debian tarballs.
  * Enable parallel builds.
  * Update standards version to 3.9.3 (no changes required).

 -- Russ Allbery <rra@debian.org>  Sat, 02 Jun 2012 19:20:27 -0700

libpam-krb5 (4.5-4) unstable; urgency=low

  * Enable bindnow hardening flags and fix the syntax of the
    DEB_BUILD_MAINT_OPTIONS setting.
  * Bump debhelper dependency to 9 now that compatibility mode V9 is no
    longer experimental.
  * Move single-debian-patch to local-options and patch-header to
    local-patch-header so that they only apply to the packages I build and
    NMUs get regular version-numbered patches.

 -- Russ Allbery <rra@debian.org>  Sat, 04 Feb 2012 13:27:02 -0800

libpam-krb5 (4.5-3) unstable; urgency=low

  * Fix build rule to not override CPPFLAGS, which deactivates some of the
    options passed in by dpkg-buildflags.  Instead, use --with-krb5-lib
    and --with-krb5-include to locate the Kerberos headers and libraries.
    Thanks, Moritz Muehlenhoff.  (Closes: #654293)

 -- Russ Allbery <rra@debian.org>  Tue, 03 Jan 2012 13:38:12 -0800

libpam-krb5 (4.5-2) unstable; urgency=low

  * Cherry-pick upstream patch to fix initialization of krb5_deltat
    defaults on systems where krb5_deltat is not a long.  Should fix FTBFS
    on s390x.

 -- Russ Allbery <rra@debian.org>  Mon, 26 Dec 2011 16:36:21 -0800

libpam-krb5 (4.5-1) unstable; urgency=low

  * New upstream release.
    - The temporary root-only ticket cache is now stored relative to
      ccache_dir rather than hard-coded to be in /tmp.
    - Suppress the notice that the password is being changed because it's
      expired if force_first_pass or use_first_pass are set in the
      password stack.
    - Confirm the password can get kadmin/changepw credentials before
      returning the status code indicating it's expired, working around a
      bug in old Heimdal versions that return expired even for incorrect
      passwords.
    - Better error reporting of authorization (such as .k5login) failures.
    - Prefer the change password protocol when linked with MIT libraries
      for better compatibility with older KDCs.
    - Improve logging and authorization when defer_pwchange is set.
    - Close some memory leaks.
    - Report symbolic names of PAM flags in debug logging.
  * Enable compiler hardening flags.
  * Remove "v5" from the long description.  Kerberos v5 has been the
    default version of Kerberos for over ten years.

 -- Russ Allbery <rra@debian.org>  Sat, 24 Dec 2011 17:34:03 -0800

# For older changelog entries, run 'apt-get changelog libpam-heimdal'
