pound (2.6-6.1ubuntu0.1) xenial-security; urgency=medium

  * SECURITY UPDATE: Request smuggling
    - debian/patches/0009-CVE-2016-10711-CVE-2018-21245.patch: avoid
      request smuggling in http.c.
    - CVE-2016-10711
    - CVE-2018-21245

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Wed, 20 Jan 2021 15:58:50 -0300

pound (2.6-6.1) unstable; urgency=medium

  * Non-maintainer upload by the security team with maintainer approval.
  * Add missing part of anti_beast patch to fix disabling of client
    renegotiation. (Closes: #765649)

 -- Thijs Kinkhorst <thijs@debian.org>  Tue, 05 May 2015 13:27:06 +0000

pound (2.6-6) unstable; urgency=low

  * Add options to disable SSLv2 and SSLv3.

 -- Brett Parker <iDunno@sommitrealweird.co.uk>  Mon, 20 Oct 2014 00:48:13 +0100

pound (2.6-5) unstable; urgency=low

  * Add MKCALENDAR support (Closes: #742488)
  * Check config file is valid for restart/force-restart (Closes: #747517)
  * Up max http size to 8k (Closes: #691941)

 -- Brett Parker <iDunno@sommitrealweird.co.uk>  Sun, 19 Oct 2014 22:31:00 +0100

pound (2.6-4) unstable; urgency=low

  * Add HTTP PATCH support
  * Add semaphore wait support (Closes: #737853)

 -- Brett Parker <iDunno@sommitrealweird.co.uk>  Mon, 03 Mar 2014 15:22:11 +0000

pound (2.6-3) unstable; urgency=low

  * New maintainer: Brett Parker <iDunno@sommitrealweird.co.uk>
  * Update xss_redirect_patch
    - Allow = character in urls (Closes: #723731)
  * Add patch from Joe Gooch <mrwizard@k12system.com> for CRIME vulnerability
    - tls_compression_disable.patch (Closes: #727197)

 -- Brett Parker <iDunno@sommitrealweird.co.uk>  Sun, 26 Jan 2014 12:40:27 +0000

pound (2.6-2) unstable; urgency=low

  * Update anti_beast patch
     - Actually authored by Joe Gooch <mrwizard@k12system.com>
     - Fix segfault on some systems
  * Added patch to fix XSS redirect vulnerability
    - Patch from Joe Gooch <mrwizard@k12system.com>
  * Switched to dpkg-buildflags (Closes: #654833)
     - Patch from Moritz Muehlenhoff <jmm@debian.org>

 -- Martin Meredith <mez@debian.org>  Fri, 03 Feb 2012 09:40:45 +0000

pound (2.6-1) unstable; urgency=low

  * New upstream release
  * Patch from Michal Jirku <box@wejn.org> to add config
    options that prevent BEAST/renegotiation attacks

 -- Martin Meredith <mez@debian.org>  Mon, 30 Jan 2012 10:21:52 +0000

pound (2.5-1.1) unstable; urgency=low

  * NMU
  * Apply patch to work with new openssl. Thanks to Ilya Barygin
    <barygin@gmail.com> for the patch. Closes: #622041
  * Add simple initial build-arch and build-indep rules as suggested by
    lintian

 -- Steve McIntyre <steve.mcintyre@linaro.org>  Thu, 12 Dec 2011 15:29:12 +0000

pound (2.5-1) unstable; urgency=low

  * New upstream release
  * Switch to dpkg-source 3.0 (quilt) format
  * Removed previous patch from #517359 - incorporated upstream
  * Added ${misc:Depends}
  * Added openssl as a B-D (New functionality to connect to SSL backends)

 -- Martin Meredith <mez@debian.org>  Wed, 10 Mar 2010 21:44:12 +0000

# For older changelog entries, run 'apt-get changelog pound'
