request-tracker4 (4.4.3-2+deb10u3build0.20.04.1) focal-security; urgency=medium

  * fake sync from Debian

 -- Amir Naseredini <amir.naseredini@canonical.com>  Wed, 22 Nov 2023 10:19:03 +0000

request-tracker4 (4.4.3-2+deb10u3) buster-security; urgency=medium

  * Apply upstream patch which fixes several security vulnerabilities
    (Closes: #1054516).
    - [CVE-2023-41259] Vulnerablility to unvalidated email headers in
      incoming email and the mail-gateway REST interface.
    - [CVE-2023-41260] Information leakage via response messages returned
      from requests sent via the mail-gateway REST interface.
  * Add upstream fix to tests for FTBFS due to expired certs.

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 08 Oct 2023 22:41:41 +1300

request-tracker4 (4.4.3-2+deb10u2) buster-security; urgency=medium

  * Apply upstream patch which fixes several security vulnerabilities.
    - A cross-site scripting (XSS) issue when displaying attachment content
      with fraudulent content types. This vulnerability is assigned
      CVE-2022-25802.
    - Not performing full rights checks on access to file or image type
      custom fields, possibly allowing access to these custom fields by
      users without rights to access to the associated objects (like the
      ticket it is associated with).

 -- Andrew Ruthven <andrew@etc.gen.nz>  Sun, 03 Jul 2022 20:09:25 +1200

request-tracker4 (4.4.3-2+deb10u1) buster; urgency=medium

  * Apply upstream patch which fixes a security vulnerability that involves a
    login timing side-channel attack. This resolves CVE-2021-38562
    (Closes: #995175)

 -- Andrew Ruthven <andrew@etc.gen.nz>  Thu, 30 Sep 2021 00:41:47 +1300

request-tracker4 (4.4.3-2) unstable; urgency=high

  * Add missing dependencies on libcpanel-json-xs-perl (Closes: #920744)

 -- Dominic Hargreaves <dom@earth.li>  Fri, 08 Feb 2019 17:50:03 +0000

request-tracker4 (4.4.3-1) unstable; urgency=medium

  [ Niels Thykier ]
  * Declare the explicit requirement for (fake)root

  [ Dominic Hargreaves ]
  * debian/bug/script: use dpkg --verify to avoid manual access to
    dpkg database (Closes: #905703)
  * New upstream release
    - Fix bug in system configuration display with regexps (Closes: #895600)
  * Drop dependency on dh-systemd (thanks, Lintian)
  * Mark rt4-standlone as being a metapackage to avoid Lintian warning 
    (Closes: #907420)
  * Replace exim4 with default-mta in Depends (thanks, Lintian)
  * Force the use of Cpanel::JSON::XS (Closes: #848041)

 -- Dominic Hargreaves <dom@earth.li>  Sun, 09 Sep 2018 22:40:16 +0100

request-tracker4 (4.4.2-2) unstable; urgency=medium

  * Don't break RT when epochs are used in the Debian version. Thanks
    to Andrew Ruthven for the patch (Closes: #881985)
  * Don't enable rt-externalize-attachments cron job by default
    (Closes: #883472)
  * Update Vcs-* fields to point to Salsa
  * Update clean target to work correctly, and ensure configure is run.
    Thanks to Andrew Ruthven for the patch (Closes: #881984)
  * Update Standards-Version (no changes)

 -- Dominic Hargreaves <dom@earth.li>  Sun, 08 Apr 2018 00:15:44 +0100

request-tracker4 (4.4.2-1) unstable; urgency=medium

  * New upstream release
    - Add database upgrade script
    - Update versioned dependency on libemail-address-perl
  * Update Standards-Version (no changes)

 -- Dominic Hargreaves <dom@earth.li>  Fri, 25 Aug 2017 23:10:11 +0100

request-tracker4 (4.4.1-5) unstable; urgency=medium

  * Fix broken config script (Closes: #865196)
  * Fix test failure with perl 5.26 caused by "Unescaped left brace in
    regex" warning (Closes: #865047)

 -- Dominic Hargreaves <dom@earth.li>  Mon, 19 Jun 2017 21:26:28 +0100

request-tracker4 (4.4.1-4) unstable; urgency=high

  * Add dependency on libhtml-gumbo-perl for better table rendering
  * Handle configuration permissions correctly following
    RT_SiteConfig.d changes (Closes: #862426)
  * Improve documentation for Apache configurations (thanks to
    Michael Howe for the text)
  * Add support for dbconfig-no-thanks opt-out (Closes: #854789)
  * Fix multiple security issues:
    - [CVE-2017-5943] CSRF verification token information leak
    - [CVE-2016-6127] XSS in file uploads
    - [CVE-2017-5361] Timing side-channel vulnerability in password
      verification
    - [CVE-2017-5944] Remote code execution in dashboard interface
    - Add check for incorrect RestrictLoginReferrer configuration setting
  * Work around a DoS vulnerability in Email::Address (CVE-2015-7686)

 -- Dominic Hargreaves <dom@earth.li>  Wed, 14 Jun 2017 23:55:29 +0100

# For older changelog entries, run 'apt-get changelog rt4-apache2'
