proftpd-dfsg (1.3.6c-2ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: terrapin attack
    - d/p/CVE-2023-48795/only-send-an-SSH-EXT_INFO-message-if-supported.patch:
      only send an SSH-EXT_INFO message if supported
    - d/p/CVE-2023-48795/implement-the-strict-KEX-mitigation.patch:
      implement the strict KEX mitigation
    - CVE-2023-48795
  * SECURITY UPDATE: out of bound read causes daemon crash
    - d/p/CVE-2023-51713.patch: skip parsing quote backslash sequence
    - CVE-2023-51713
  * ignore-supplemental-groups-when-run-as-nonroot.patch: fix dropping privs
    when running as non-root
  * SECURITY UPDATE: privilege escalation due to missing group checks
    - d/p/CVE-2024-48651.patch: only set group for daemon to primary gid
    - CVE-2024-48651
  * fix-radius-signature-for-RFC-2869.patch: fix the computation of the RADIUS
    Message-Authenticator signature to conform more properly to RFC 2869

 -- Sudhakar Verma <sudhakar.verma@canonical.com>  Wed, 05 Feb 2025 16:13:43 +0530

proftpd-dfsg (1.3.6c-2) unstable; urgency=medium

  * Add patch from upstream as follow up for CVE-2020-9273
    cd9036f4ef7a05c107f0ffcb19a018b20267c531.patch
    (Closes: #952557).

 -- Hilmar Preusse <hille42@web.de>  Thu, 27 Feb 2020 20:34:56 +0100

proftpd-dfsg (1.3.6c-1) unstable; urgency=medium

  * New upstream version.
    Contains support for OpenSSH-specific private key format
    (Closes: #932373).
  * A few patches are obsolete (included upstream):
    - quotatab_modules (was not installed anyway)
    - upstream_pull_859_861_CVE-2019-19270_CVE-2019-19269
    - upstream_4385
  * Patches refreshed.

 -- Hilmar Preusse <hille42@web.de>  Thu, 20 Feb 2020 13:52:22 +0100

proftpd-dfsg (1.3.6b-3) unstable; urgency=medium

  * Cherry pick "upstream_4385" from upstream:
   - for upstream #4385 (Closes: #949622)

 -- Hilmar Preusse <hille42@web.de>  Wed, 22 Jan 2020 23:12:44 +0100

proftpd-dfsg (1.3.6b-2) unstable; urgency=medium

  * Cherry pick patch from upstream:
    - for upstream 861 (CVE-2019-19269) (Closes: #946345)
    - for upstream 859 (CVE-2019-19270) (Closes: #946346)
    upstream_pull_859_861_CVE-2019-19270_CVE-2019-19269

 -- Hilmar Preusse <hille42@web.de>  Sun, 08 Dec 2019 14:03:43 +0100

proftpd-dfsg (1.3.6b-1) unstable; urgency=medium

  * New upstream release:
    - Obsoletes patch issue_846_CVE-2019-18217.diff.
    - Backported fix for building mod_sql_mysql using MySQL 8 (Issue #824).

 -- Hilmar Preusse <hille42@web.de>  Mon, 04 Nov 2019 22:08:07 +0100

proftpd-dfsg (1.3.6a-2) unstable; urgency=high

  * Add patch for upstream bug #846 (CVE-2019-18217).
    (Closes: #942831)

 -- Hilmar Preusse <hille42@web.de>  Tue, 22 Oct 2019 13:30:36 +0200

proftpd-dfsg (1.3.6a-1) unstable; urgency=medium

  * New upstream patch release. Obsoletes patches included in upstream:
    - upstream_4372_CVE-2019-12815.diff
    - upstream_4312, upstream_4312_fix_version
    - upstream_4356
    - upstream_4335
    - upstream_4336 (although not mentioned in upstream changelog)
    - github_pr_710 (although not mentioned in upstream changelog)
    - github_pr_594 (although not mentioned in upstream changelog)
    - upstream_pull_567 = Bug#4314
  * Lintian Override: proftpd-dev: pkg-config-multi-arch-wrong-dir
    (file is generated during build).

 -- Hilmar Preusse <hille42@web.de>  Mon, 14 Oct 2019 10:36:04 +0200

proftpd-dfsg (1.3.6-6) unstable; urgency=medium

  * Document that proftpd read all files from /etc/proftpd/conf.d/
    (Closes: #814772).
  * Add patch upstream_4372_CVE-2019-12815.diff to solve CVE-2019-12815.
    (Closes: #932453)

 -- Hilmar Preusse <hille42@web.de>  Tue, 23 Jul 2019 21:04:28 +0200

proftpd-dfsg (1.3.6-5) unstable; urgency=medium

  [ Francesco Paolo Lovergine ]
  * Set the SE Linux context after creating a directory.
    (Closes: #923033)
  * Get upstream pull_567 (Bug#4314) (Closes: #927270)
  * Bump Standards-Version to 4.4.0.
    - make sure we don't call "strip" w/o using dh_strip.

 -- Hilmar Preusse <hille42@web.de>  Tue, 16 Jul 2019 23:34:25 +0200

# For older changelog entries, run 'apt-get changelog proftpd-doc'
