Change log : libssh package : Debian

0.11.1-1

Published in sid-release on 2024-09-04

libssh (0.11.1-1) unstable; urgency=medium

  [ Simon Josefsson ]
  * New upstream version 0.11.1 (Closes: #1078677)
  * Add new upstream signing key to d/upstream/signing-key.asc
  * Refresh patches for new upstream release.
    Drop 0001-Fix-regression-in-IPv6-addresses-in-hostname-parsing.patch and
    0002-tests-Increase-test-coverage-for-IPv6-address-parsin.patch, applied
    upstream.
  * Update symbols file
  * Use pkgconf instead of obsolete pkg-config
  * Add d/upstream/metadata
  * Bump d/copyright years

  [ Bastian Germann ]
  * Drop gcrypt flavor (Closes: #1074337)
  * d/copyright: Move blowfish files to their own section

  [ Martin Pitt ]
  * Bump Standards-Version to 4.7.0

  [ Debian Janitor ]
  * debian/control: Remove constraints unnecessary since buster (oldstable)

 -- Martin Pitt <email address hidden>  Wed, 04 Sep 2024 08:27:52 +0200

Available diffs

diff from 0.10.6-3ubuntu1 (in Ubuntu) to 0.11.1-1 (330.6 KiB)

0.10.6-3

Superseded in sid-release on 2024-12-29

libssh (0.10.6-3) unstable; urgency=medium

  * debian/copyright: Add bcrypt_pbkdf.c (Closes: #1071567)

 -- Martin Pitt <email address hidden>  Mon, 03 Jun 2024 07:32:19 +0200

Available diffs

diff from 0.10.6-2build2 (in Ubuntu) to 0.10.6-3 (1.3 KiB)

0.9.8-0+deb11u1

Published in bullseye-release on 2024-02-10

libssh (0.9.8-0+deb11u1) bullseye-security; urgency=medium

  * New upstream security release:
    - Fix Command injection using ProxyCommand
      (CVE-2023-6004, Closes: #1059061)
    - Fix missing checks for return values of MD functions
      (CVE-2023-6918, Closes: #1059059)
    - Fix potential downgrade attack using strict kex
      (CVE-2023-48795, Closes: #1059004)
  * Fix regression in IPv6 addresses in hostname parsing from CVE-2023-6004
    fix. Patch and unit test backported from upstream stable-0.9 branch.
    See https://gitlab.com/libssh/libssh-mirror/-/issues/227

 -- Martin Pitt <email address hidden>  Mon, 25 Dec 2023 11:40:33 +0100

0.10.6-0+deb12u1

Published in bookworm-release on 2024-02-10

libssh (0.10.6-0+deb12u1) bookworm-security; urgency=medium

  * New upstream security release:
   - Fix Command injection using ProxyCommand
     (CVE-2023-6004, Closes: #1059061)
   - Fix missing checks for return values of MD functions
     (CVE-2023-6918, Closes: #1059059)
   - Fix potential downgrade attack using strict kex
     (CVE-2023-48795, Closes: #1059004)
  * Fix regression in IPv6 addresses in hostname parsing from CVE-2023-6004
    fix.  Patch and unit test backported from upstream stable-0.10 branch.
    See https://gitlab.com/libssh/libssh-mirror/-/issues/227

 -- Martin Pitt <email address hidden>  Mon, 25 Dec 2023 11:15:40 +0100

0.10.6-2

Superseded in sid-release on 2024-06-03

libssh (0.10.6-2) unstable; urgency=medium

  * Fix regression in IPv6 addresses in hostname parsing.
    Patch and unit test backported from upstream stable-0.10 branch.
    See https://gitlab.com/libssh/libssh-mirror/-/issues/227

 -- Martin Pitt <email address hidden>  Fri, 22 Dec 2023 16:29:47 +0100

Available diffs

diff from 0.10.5-3ubuntu2 (in Ubuntu) to 0.10.6-2 (30.3 KiB)

0.10.6-1

Superseded in sid-release on 2023-12-22

libssh (0.10.6-1) unstable; urgency=high

  * New upstream security release (thus high urgency):
    - Fix Command injection using ProxyCommand
      (CVE-2023-6004, Closes: #1059061)
    - Fix missing checks for return values of MD functions
      (CVE-2023-6918, Closes: #1059059)
    - Fix potential downgrade attack using strict kex
      (CVE-2023-48795, Closes: #1059004)

 -- Martin Pitt <email address hidden>  Fri, 22 Dec 2023 09:46:12 +0100

0.9.7-0+deb11u1

Superseded in bullseye-release on 2024-02-10

libssh (0.9.7-0+deb11u1) bullseye-security; urgency=medium

  * New upstream security microrelease:
    - CVE-2023-1667: Authenticated remote DoS.
      Fix authenticated remote DoS through potential NULL dereference during
      rekeying with algorithm guessing
      https://www.libssh.org/security/advisories/CVE-2023-1667.txt
    - CVE-2023-2283: Client authentication bypass.
      Fix client authentication bypass in pki_verify_data_signature() in
      low-memory conditions with OpenSSL backend; gcrypt backend is not
      affected.
      https://www.libssh.org/security/advisories/CVE-2023-2283.txt
      (Closes: #1035832)
  * Drop 000* patches which were backported from the upstream stable 0.9
    branch, now included in this release. Unfuzz 2004-install-static-lib.patch.

 -- Martin Pitt <email address hidden>  Sun, 21 May 2023 18:22:05 +0000

0.10.5-3

Superseded in sid-release on 2023-12-22

libssh (0.10.5-3) unstable; urgency=medium

  * Bump debhelper compat level to 13.
  * Remove compile_commands.json during package cleaning. Fixes "Fails to
    build source after successful build". (Closes: #1045639)

 -- Martin Pitt <email address hidden>  Fri, 18 Aug 2023 17:01:59 +0200

Available diffs

diff from 0.10.5-2 to 0.10.5-3 (608 bytes)

0.10.5-2

Superseded in bookworm-release on 2024-02-10

Superseded in sid-release on 2023-08-20

libssh (0.10.5-2) unstable; urgency=medium

  * Revert "Bump debhelper from old 12 to 13."
    This is not appropriate at this point of the release cycle any more.

 -- Martin Pitt <email address hidden>  Wed, 17 May 2023 19:56:56 +0000

Available diffs

diff from 0.10.5-1 to 0.10.5-2 (519 bytes)

0.10.5-1

Superseded in sid-release on 2023-05-18

libssh (0.10.5-1) unstable; urgency=high

  [ Martin Pitt ]
  * New upstream security release (thus high urgency):
    - Fix authenticated remote DoS through potential NULL dereference during rekeying
      with algorithm guessing (CVE-2023-1667)
      https://www.libssh.org/security/advisories/CVE-2023-1667.txt
    - Client authentication bypass in pki_verify_data_signature() in low-memory
      conditions with OpenSSL backend; gcrypt backend is not affected
      https://www.libssh.org/security/advisories/CVE-2023-2283.txt
      (CVE-2023-2283, Closes: #1035832)
  * Bump Standards-Version to 4.6.2. No changes necessary.
  * Drop debian/source/lintian-overrides. It now causes a "mismatched-override"
    warning, and apparently is not necessary any more.
  * debian/copyright: Drop files which don't exist any more.
    Spotted by lintian's "superfluous-file-pattern" warnings.

  [ Debian Janitor ]
  * Bump debhelper from old 12 to 13.
  * Avoid explicitly specifying -Wl,--as-needed linker flag.

 -- Martin Pitt <email address hidden>  Wed, 10 May 2023 08:00:26 +0200

0.10.4-2

Superseded in sid-release on 2023-05-10

libssh (0.10.4-2) unstable; urgency=medium

  * autopkgtest: Drop valgrind run. This hasn't worked for years on many
    architectures, is also acting up on s390x, and does not belong into a
    downstream integration test.

 -- Martin Pitt <email address hidden>  Mon, 19 Sep 2022 10:41:22 +0200

Available diffs

diff from 0.9.6-2build1 (in ~ci-train-ppa-service/ubuntu/4815-deletedppa) to 0.10.4-2 (289.6 KiB)

0.10.4-1

Superseded in sid-release on 2022-09-20

libssh (0.10.4-1) unstable; urgency=medium

  * New upstream release (Closes: #1019260)
  * Disable new tilde expansion test. This does not work in our buildd
    environment for the same reason as the two in torture_misc. Update
    debian/patches/2003-disable-expand_tilde_unix-test.patch accordingly.
  * debian/*.symbols: Add newly exported symbols
  * Bump Standards-Version to 4.6.1. No changes needed.

 -- Martin Pitt <email address hidden>  Wed, 14 Sep 2022 08:13:19 +0200

0.9.6-2

Superseded in sid-release on 2022-09-14

libssh (0.9.6-2) unstable; urgency=medium

  [ Helmut Grohne ]
  * debian/control: Add preferred real zlib1g-dev build dep.
    As libz-dev is purely virtual.
  * Mark build dependencies for running unit tests.
    This reduces dependencies for bootstrapping. (Closes: #1002598)

  [ Martin Pitt ]
  * debian/copyright: Update and generalize. Replace some over-specific
    patterns with globs. A lot of files did not exist any more, a lot of new
    copyrights were missing.  Spotted by lintian.
  * Adjust lintian overrides to renamed tag.
  * Quiesce very-long-line-length-in-source-file lintian warning for test keys
  * Mark Debian specific patches as not needing upstream forwarding.
    This quiesces two lintian complaints for `patch-not-forwarded-upstream`.
    Don't mark 1003-custom-lib-names.patch, as that one actually is suitable
    for upstream.

 -- Martin Pitt <email address hidden>  Sat, 25 Dec 2021 19:36:01 +0100

Available diffs

diff from 0.9.6-1build1 (in Ubuntu) to 0.9.6-2 (3.1 KiB)

0.9.5-1+deb11u1

Superseded in bullseye-release on 2023-10-07

libssh (0.9.5-1+deb11u1) bullseye-security; urgency=high

  * dh-gex: Avoid memory leaks.
    Add 0001-dh-gex-Avoid-memory-leaks.patch: Backported from upstream 0.9.6
    release.
  * Fix handshake bug with AEAD ciphers and no HMAC overlap.
    Add 0002-Fix-handshake-bug-with-AEAD-ciphers-and-no-HMAC-over.patch and
    0003-Add-initial-server-algorithm-test-for-no-HMAC-overla.patch:
    Backport fix and test from upstream 0.9.6 release.
  * Create a separate length for session_id.
    Add 0004-CVE-2021-3634-Create-a-separate-length-for-session_i.patch and
    0005-tests-Simple-reproducer-for-rekeying-with-different-.patch:
    Backport fix and test from upstream 0.9.6 release.
    CVE-2021-3634 (Closes: #993046)

 -- Martin Pitt <email address hidden>  Sat, 28 Aug 2021 13:52:11 +0200

0.9.6-1

Superseded in sid-release on 2021-12-26

libssh (0.9.6-1) unstable; urgency=medium

  * New upstream version 0.9.6:
    - Fix possible heap-buffer overflow when rekeying with different key
      exchange mechanism (Closes: #993046, CVE-2021-3634)
  * Refresh 2004-install-static-lib.patch for new upstream version
  * Bump Standards-Version to 4.6.0. No changes necessary.
  * debian/control: Declare Rules-Requires-Root: no

 -- Martin Pitt <email address hidden>  Sat, 28 Aug 2021 12:51:05 +0200

Available diffs

diff from 0.9.5-1 to 0.9.6-1 (25.2 KiB)
diff from 0.9.5-1ubuntu1 (in Ubuntu) to 0.9.6-1 (27.3 KiB)

0.9.5-1

Superseded in bullseye-release on 2021-10-09

Superseded in sid-release on 2021-08-29

libssh (0.9.5-1) unstable; urgency=medium

  [ Laurent Bigonville ]
  * New upstream version 0.9.5
    - Fix a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns
      NULL. (Closes: #966560 CVE-2020-16135)
  * Drop d/p/1004-hurd-ftbfs.patch, applied upstream
  * Drop d/p/1005-reproducible-doc.patch, applied upstream
  * debian/control: Add openssh-server to the BD

  [ Sebastien Bacher ]
  * debian/control: don't build with nacl, it's not needed when building
    openssl, see https://bugs.libssh.org/T235 (Closes: #964134)

 -- Laurent Bigonville <email address hidden>  Wed, 18 Nov 2020 10:01:23 +0100

Available diffs

diff from 0.9.4-2ubuntu1 (in Ubuntu) to 0.9.5-1 (23.0 KiB)

0.9.4-2

Superseded in sid-release on 2020-11-18

libssh (0.9.4-2) unstable; urgency=medium

  [ Debian Janitor ]
  * Trim trailing whitespace.
  * Set debhelper-compat version in Build-Depends.
  * Drop transition for old debug package migration.

  [ Colin Watson ]
  * Fix autopkgtests with OpenSSH 8.4p1 (closes: #974039).

  [ Laurent Bigonville ]
  * debian/copyright: Remove duplicate in the list of files (tests/torture.c)

 -- Laurent Bigonville <email address hidden>  Thu, 12 Nov 2020 15:01:03 +0100

0.8.7-1+deb10u1

Published in buster-release on 2020-05-09

libssh (0.8.7-1+deb10u1) buster; urgency=medium

  * Fix possible DoS in client and server when handling AES-CTR keys with
    OpenSSL, cherry-picked from upstream (Closes: #956308 CVE-2020-1730)

 -- Laurent Bigonville <email address hidden>  Tue, 28 Apr 2020 13:40:28 +0200

0.9.4-1

Superseded in sid-release on 2020-11-12

libssh (0.9.4-1) unstable; urgency=medium

  * New upstream release
    - Fix possible DoS in client and server when handling AES-CTR keys with
      OpenSSL (Closes: #956308 CVE-2020-1730)
  * debian/control: Bump Standards-Version to 4.5.0 (no further changes)
  * Add default debian/salsa-ci.yml file
  * d/p/1004-hurd-ftbfs.patch: Fix FTBFS on hurd-i386 (Closes: #933015)
  * d/p/1005-reproducible-doc.patch: Make the documentation reproducible

 -- Laurent Bigonville <email address hidden>  Thu, 09 Apr 2020 22:27:02 +0200

0.9.3-2

Superseded in sid-release on 2020-04-10

libssh (0.9.3-2) unstable; urgency=medium

  * debian/rules: Rename libssh-gcrypt.a to libssh.a to ensure that the
    correct static library is installed in the libssh-gcrypt-dev package

 -- Laurent Bigonville <email address hidden>  Sun, 15 Dec 2019 19:18:53 +0100

0.9.3-1

Superseded in sid-release on 2019-12-16

libssh (0.9.3-1) unstable; urgency=medium

  [ Laurent Bigonville ]
  * New upstream release
    - Fix an nsanitized location in scp that could lead to unwanted command
      execution (Closes: #946548 CVE-2019-14889)
    - d/p/1003-custom-lib-names.patch: Refreshed
    - d/p/2003-disable-expand_tilde_unix-test.patch: Refreshed
    - debian/rules: Fix the parameter name used to build the static library
    - debian/patches/install_static_lib.patch: Install the static library again
  * debian/control: Bump Standards-Version to 4.4.1 (no further changes)
  * Bump debhelper compatibility to 12

  [ Sebastien Bacher ]
  * debian/tests/libssh-server:
    - Use the correct compiler for proposed autopkgtest cross-testing
      support. (Closes: #946536)

 -- Laurent Bigonville <email address hidden>  Sun, 15 Dec 2019 12:46:20 +0100

0.9.0-1

Superseded in sid-release on 2019-12-15

libssh (0.9.0-1) unstable; urgency=medium

  * New upstream release 
    - debian/*.symbols: Add newly exported symbols
  * debian/control: Bump Standards-Version to 4.4.0 (no further changes)

 -- Laurent Bigonville <email address hidden>  Thu, 11 Jul 2019 12:35:29 +0200

Available diffs

diff from 0.8.7-1 to 0.9.0-1 (245.3 KiB)

0.8.7-1

Superseded in buster-release on 2020-05-09

Superseded in sid-release on 2019-07-11

libssh (0.8.7-1) unstable; urgency=medium

  * New upstream bug fix release 0.8.7.
    This fixes various crashes, buffer overflows, and other bugs.
    Drop our three backported patches, they are included in this release
    now. For details, see
    https://git.libssh.org/projects/libssh.git/log/?h=stable-0.8
  * autopkgtest: Check ssh server under valgrind.
    This exposes a long-standing libssh bug with the curve25519-sha256 key
    exchange algorithm, causing an "incorrect signature" failure on 32 bit
    machines under valgrind. Add a hack to switch to a different algorithm,
    until this is properly investigated and reported.

 -- Martin Pitt <email address hidden>  Thu, 23 May 2019 08:55:12 +0000

Available diffs

diff from 0.8.6-3 to 0.8.7-1 (12.3 KiB)

0.7.3-2+deb9u2

Published in stretch-release on 2019-02-16

libssh (0.7.3-2+deb9u2) stretch; urgency=medium

  * Non-maintainer upload.
  * Fix broken server-side keyboard-interactive authentication.
    Thanks to Martin Pitt (Closes: #913870)

 -- Salvatore Bonaccorso <email address hidden>  Mon, 31 Dec 2018 14:47:15 +0100

0.8.6-3

Superseded in buster-release on 2019-05-26

Superseded in sid-release on 2019-06-04

libssh (0.8.6-3) unstable; urgency=medium

  [ Laurent Bigonville ]
  * Add Built-Using field to track the version of nacl libssh has been
    statically linked against

  [ Martin Pitt ]
  * autopkgtest: Let the server fork after opening the socket and print its
    pid, to avoid a race between server and client. (Closes: #922073)
  * 0003-pki_signature_from_rsa_blob-NULL-check.patch: pki: NULL check
    pki_signature_from_rsa_blob result. Patch taken from upstream stable-0.8
    branch.

 -- Martin Pitt <email address hidden>  Mon, 11 Feb 2019 20:43:44 +0000

Available diffs

diff from 0.8.6-2 to 0.8.6-3 (2.7 KiB)

0.8.6-2

Superseded in buster-release on 2019-02-22

Superseded in sid-release on 2019-02-17

libssh (0.8.6-2) unstable; urgency=medium

  * 0001-dh-uninitialized-memory.patch: dh: Make sure we do not access
    uninitialized memory.  Patch taken from upstream stable-0.8 branch.
  * 0002-server-extensions.patch: server: Correctly handle extensions.
    Fixes a regression introduced in 0.8.6 that breaks server-side host key
    algorithm negotiation.  Patch taken from upstream stable-0.8 branch.
    (Closes: #918892)
  * Add Martin Pitt as co-maintainer, with Laurent's permission.
  * Add autopkgtest: Add a mock ssh server implementation using libssh, and
    test the OpenSSH client against it. This covers password and pubkey
    authentication.

 -- Martin Pitt <email address hidden>  Tue, 15 Jan 2019 09:51:01 +0000

Available diffs

diff from 0.8.6-1 to 0.8.6-2 (11.5 KiB)

0.8.6-1

Superseded in buster-release on 2019-01-21

Superseded in sid-release on 2019-01-15

libssh (0.8.6-1) unstable; urgency=medium

  * New upstream version 0.8.6
  * debian/control: Bump Standards-Version to 4.3.0 (no further changes)
  * debian/gbp.conf: s/git-buildpackage/buildpackage
  * debian/control: Fix the phrasing of some short description, to please
    lintian

 -- Laurent Bigonville <email address hidden>  Sat, 29 Dec 2018 13:21:46 +0100

Available diffs

diff from 0.8.5-1 to 0.8.6-1 (16.9 KiB)

0.8.5-1

Superseded in buster-release on 2019-01-03

Superseded in sid-release on 2018-12-30

libssh (0.8.5-1) unstable; urgency=medium

  [ Laurent Bigonville ]
  * New upstream release  (Closes: #913242)
    - Fix regression with server-side keyboard-interactive authentication
  * debian/watch: Fix the watch file so new version are properly displayed on
    the tracker webpage
  * debian/control: Mark -dev packages as Multi-Arch: same
  * debian/*.symbols: Add Build-Depends-Package field
  * Drop debian/upstream-signing-key.pgp, the recommended location is
    debian/upstream/signing-key.asc
  * debian/libssh-gcrypt-4.lintian-overrides: Fix the override so it's not
    needed to update it at every release

  [ Helmut Grohne ]
  * Fix FTCBFS: Annotate python3 build dependency with :any. (Closes: #913115)

 -- Laurent Bigonville <email address hidden>  Wed, 21 Nov 2018 13:38:38 +0100

Available diffs

diff from 0.8.4-3 to 0.8.5-1 (24.9 KiB)

0.7.3-2+deb9u1

Superseded in stretch-release on 2019-02-16

libssh (0.7.3-2+deb9u1) stretch-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * Authentication bypass vulnerability (CVE-2018-10933) (Closes: #911149)

 -- Salvatore Bonaccorso <email address hidden>  Tue, 16 Oct 2018 21:18:05 +0200

0.8.4-3

Superseded in buster-release on 2018-11-26

Superseded in sid-release on 2018-11-22

libssh (0.8.4-3) unstable; urgency=medium

  * debian/rules: Do not run the tests in parallel, should fix some FTBFS

 -- Laurent Bigonville <email address hidden>  Wed, 17 Oct 2018 09:17:49 +0200

Available diffs

diff from 0.8.1-1ubuntu0.1 (in ~ubuntu-security/ubuntu/ppa) to 0.8.4-3 (163.7 KiB)

0.8.4-2

Superseded in sid-release on 2018-10-17

libssh (0.8.4-2) unstable; urgency=medium

  * debian/rules: Only build the documentation if doxygen is installed or the
    nodoc profile not set

 -- Laurent Bigonville <email address hidden>  Tue, 16 Oct 2018 18:19:16 +0200

0.8.1-1

Superseded in buster-release on 2018-10-22

Superseded in sid-release on 2018-10-17

libssh (0.8.1-1) unstable; urgency=medium

  * New upstream version 0.8.1
    - Fix Version field in pkg-config file (Closes: #906049)
  * debian/*-dev.install: Install the libssh-config.cmake file
  * debian/libssh-gcrypt-4.lintian-overrides: Adjust soname of the library

 -- Laurent Bigonville <email address hidden>  Tue, 14 Aug 2018 09:43:56 +0200

Available diffs

diff from 0.8.0~20170825.94fa1e38-1build1 (in Ubuntu) to 0.8.1-1 (205.9 KiB)
diff from 0.8.0-1 to 0.8.1-1 (4.2 KiB)

0.8.0-1

Superseded in sid-release on 2018-08-14

libssh (0.8.0-1) unstable; urgency=medium

  * debian/watch: Update the URL to point to the new URL
  * New upstream version 0.8.0 (Closes: #875872, #904958)
  * Drop patches merged upstream and refresh the others
  * Add python3 to the build-deps, required by the build system
  * Remove the libssh_threads library that is not built upstream anymore.
    Add Breaks against packages linking against this library
  * debian/*.symbols: Update the symbols files
  * debian/control: Bump Standards-Version to 4.2.0 (no further changes)

 -- Laurent Bigonville <email address hidden>  Sat, 11 Aug 2018 15:55:18 +0200

Available diffs

diff from 0.8.0~20170825.94fa1e38-2 to 0.8.0-1 (202.4 KiB)

0.8.0~20170825.94fa1e38-2

Superseded in sid-release on 2018-08-11

libssh (0.8.0~20170825.94fa1e38-2) unstable; urgency=medium

  [ Matteo F. Vescovi ]
  * debian/control:
    - libnacl-dev b-dep added
    - S-V bump 4.0.0 -> 4.1.4 (no changes needed)
    - Vcs-* fields pointing to salsa
  * debian/: symbols files updated
  * debian/: debhelper bump 9 -> 11
  * debian/rules:
    - drop get-orig-source directive
  * debian/libssh-doc.doc-base: paths updated
  * debian/copyright: http:// -> https:// for format

  [ Laurent Bigonville ]
  * Fix installation of examples
  * Drop debian/libssh-doc.manpages, the manpages are not generated anymore
  * debian/*.symbols: Thighten the version for the new symbols
  * debian/patches/1003-custom-lib-names.patch: Fix grammar to please lintian
  * debian/control: Remove unnecessary Conflicts against libssh-2-doc and
    libssh-2-dev packages (Closes: #885208)

 -- Laurent Bigonville <email address hidden>  Thu, 07 Jun 2018 14:57:50 +0200

0.8.0~20170825.94fa1e38-1

Superseded in buster-release on 2018-08-20

Superseded in sid-release on 2019-06-04

libssh (0.8.0~20170825.94fa1e38-1) unstable; urgency=medium

  [ Laurent Bigonville ]
  * debian/watch: Verify the signature of the upstream tarball
  * debian/libssh-gcrypt-4.lintian-overrides: Adjust the overrides

  [ Matteo F. Vescovi ]
  * New upstream git snapshot (based on commit 94fa1e38) (Closes: #828413)
  * debian/patches/: patchset refreshed against snapshot release
  * debian/: symbols files refreshed for snapshot release
  * debian/control: bump OpenSSL b-dep to use 1.1 version
  * debian/copyright: entried updated
  * debian/copyright.in: drop useless file
  * debian/patches/: patchset updated
    - 2004-fix-upstream-version.patch added

 -- Laurent Bigonville <email address hidden>  Wed, 13 Sep 2017 14:36:14 +0200

Available diffs

diff from 0.7.5-1 to 0.8.0~20170825.94fa1e38-1 (137.3 KiB)

0.7.5-1

Superseded in buster-release on 2017-09-18

Superseded in sid-release on 2017-09-13

libssh (0.7.5-1) unstable; urgency=medium

  * New upstream release.
  * debian/control: Bump Standards-Version to 4.0.0 (no further changes)
  * debian/libssh-gcrypt-4.lintian-overrides: Adjust library soname to the new
    release

 -- Laurent Bigonville <email address hidden>  Mon, 03 Jul 2017 15:29:04 +0200

Available diffs

diff from 0.7.3-2 to 0.7.5-1 (12.8 KiB)

0.7.3-2

Superseded in stretch-release on 2018-11-10

Superseded in sid-release on 2017-07-15

libssh (0.7.3-2) unstable; urgency=medium

  * debian/control: Explicitly build against openssl1.0 for now as libssh
    doesn't support 1.1 yet (Closes: #828413, #845197)
  * debian/copyright: Fix short licence for files in the public domain.
  * debian/copyright: More fixes to the copyright file
  * debian/rules: Enable all hardening flags

 -- Laurent Bigonville <email address hidden>  Tue, 29 Nov 2016 15:58:36 +0100

Available diffs

diff from 0.7.3-1 to 0.7.3-2 (1.3 KiB)

0.7.3-1

Superseded in stretch-release on 2016-12-24

Superseded in sid-release on 2016-11-29

libssh (0.7.3-1) unstable; urgency=medium

  * New upstream release. (Closes: #805030)
    - debian/control: Bump build-dependencies
    - Update the .symbols files, add the new exported symbols
    - Drop 0001_CVE-2014-8132.patch, 0002_CVE-2015-3146.patch,
      0003_CVE-2016-0739.patch: Applied upstream
    - 1003-custom-lib-names.patch, 2003-disable-expand_tilde_unix-test.patch:
      Refreshed
    - Drop 2002-fix-html-doc-generation.patch, gcc-5.diff: Not needed anymore
  * Drop -dbg package and rely on the automatically built -dbgsym ones
  * debian/control: Bump Standards-Version to 3.9.8 (no further changes)
  * debian/control: Use https URL's for Vcs-* and Homepage fields
  * debian/copyright: Updated

 -- Laurent Bigonville <email address hidden>  Fri, 10 Jun 2016 00:27:07 +0200

Available diffs

diff from 0.6.3-4.3 to 0.7.3-1 (263.1 KiB)

0.5.4-1+deb7u3

Published in wheezy-release on 2016-04-02

libssh (0.5.4-1+deb7u3) wheezy-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * CVE-2016-0739: Truncated Diffie-Hellman secret length (Closes: #815663)

 -- Salvatore Bonaccorso <email address hidden>  Tue, 23 Feb 2016 16:23:48 +0100

0.6.3-4+deb8u2

Published in jessie-release on 2016-04-02

libssh (0.6.3-4+deb8u2) jessie-security; urgency=high

  * Non-maintainer upload by the Security Team.
  * CVE-2016-0739: Truncated Diffie-Hellman secret length (Closes: #815663)

 -- Salvatore Bonaccorso <email address hidden>  Tue, 23 Feb 2016 16:00:29 +0100

0.6.3-4.3

Superseded in stretch-release on 2016-06-15

Superseded in sid-release on 2016-06-10

libssh (0.6.3-4.3) unstable; urgency=medium

  * Non-maintainer upload.
  * CVE-2016-0739: Truncated Diffie-Hellman secret length (Closes: #815663)

 -- Salvatore Bonaccorso <email address hidden>  Tue, 23 Feb 2016 19:54:04 +0100

Available diffs

diff from 0.6.3-4.2ubuntu1 (in Ubuntu) to 0.6.3-4.3 (1.7 KiB)

0.6.3-4+deb8u1

Superseded in jessie-release on 2016-04-02

libssh (0.6.3-4+deb8u1) jessie; urgency=medium

  * Non-maintainer upload.
  * debian/patches:
    - Add 0002_CVE-2015-3146.patch
      Fix "null pointer dereference due to a logical error in the handling
      of a SSH_MSG_NEWKEYS and KEXDH_REPLY packets"
      (Closes: #784404, CVE-2015-3146)

 -- Christopher Knadle <email address hidden>  Mon, 23 Nov 2015 08:43:19 -0500

0.6.3-4.2

Superseded in stretch-release on 2016-03-05

Superseded in sid-release on 2016-02-29

libssh (0.6.3-4.2) unstable; urgency=medium

  * Non-maintainer upload.
  * debian/patches: Add 0002_CVE-2015-3146.patch from 0.6.5 release upstream
    (Closes: #784404)

 -- Christopher Knadle <email address hidden>  Mon, 16 Nov 2015 04:26:51 -0500

Available diffs

diff from 0.6.3-4.1 to 0.6.3-4.2 (2.0 KiB)

0.6.3-4.1

Superseded in stretch-release on 2015-11-27

Superseded in sid-release on 2015-11-22

libssh (0.6.3-4.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix "ftbfs with GCC-5": add patch from Matthias Klose/Ubuntu:
    add __extension__ to __FUNCTION__.
    (Closes: #777975)

 -- gregor herrmann <email address hidden>  Sat, 18 Jul 2015 20:38:30 +0200

Available diffs

diff from 0.6.3-3ubuntu3 (in Ubuntu) to 0.6.3-4.1 (2.6 KiB)

0.6.3-4

Superseded in stretch-release on 2015-07-30

Superseded in jessie-release on 2016-01-23

Superseded in sid-release on 2015-07-24

libssh (0.6.3-4) unstable; urgency=medium


  * Add debian/patches/0001_CVE-2014-8132.patch: Fixup error path in
    ssh_packet_kexinit() (Closes: #773577, CVE-2014-8132)

 -- Laurent Bigonville <email address hidden>  Tue, 27 Jan 2015 00:28:01 +0100

0.6.3-3

Superseded in jessie-release on 2015-02-01

Superseded in sid-release on 2015-01-27

libssh (0.6.3-3) unstable; urgency=low


  [ Sebastian Ramacher ]
  * Build gcrypt flavor. (Closes: #676650)
  * d/control:
    - Add Build-Dep on libgcrypt-dev.
    - Bump Build-Dep on debhelper to >= 9 and remove cdbs.
    - Add libssh-gcrypt-dev and libssh-gcrypt-4 packages.
    - Add Conflicts to libssh-dev and libssh-gcrypt-dev against each other.
    - Add Depends on libssh-gcrypt-4 to libssh-dbg and break incompatible
      versions.
    - Update libssh-4 and libssh-dev Description.
  * d/compat: Bump to 9.
  * d/rules: Convert to dh and build gcrypt flavor.
  * d/libssh-doc.docs: Update location of documentation.
  + d/patches/1003-custom-lib-names.patch: Allow to overwrite libssh's
    OUTPUT_NAME.

  [ Laurent Bigonville ]
  * debian/libssh-gcrypt-4.lintian-overrides: Add an override for
    the dev-pkg-without-shlib-symlink lintian warning
  * debian/control, debian/rules: Enable the tests at build time, really
    (Closes: #744403)
  * debian/control: Add pkg-config to the build-dependencies
  * d/p/2003-disable-expand_tilde_unix-test.patch: Disable
    torture_path_expand_tilde_unix it's not working well on the buildd
  * d/p/0007-security-fix-for-vulnerability-CVE-2014-0017.patch: Drop obsolete
    patch, merged upstream in 0.6.3
  * debian/rules: Pass -Wl,-z,defs -Wl,-O1 -Wl,--as-needed to the LDFLAGS
  * Enable GSSAPI support
    - debian/control: Add libkrb5-dev | heimdal-dev to the build-dependencies
    - debian/rules: Pass -DWITH_GSSAPI=ON to the CMake flags
    - Adjust the .symbols file

 -- Laurent Bigonville <email address hidden>  Sat, 30 Aug 2014 17:31:14 +0200

Available diffs

diff from 0.6.3-2 to 0.6.3-3 (7.6 KiB)

0.4.5-3+squeeze2

Published in squeeze-release on 2014-07-19

libssh (0.4.5-3+squeeze2) squeeze-security; urgency=high


  * Old-stable security update: Reset the PRNG state after accepting a new
    connection (CVE-2014-0017)

 -- Laurent Bigonville <email address hidden>  Fri, 07 Mar 2014 16:58:56 +0100

0.6.3-2

Superseded in jessie-release on 2014-09-10

Superseded in sid-release on 2015-07-27

libssh (0.6.3-2) unstable; urgency=low


  [ Mike Gabriel ]
  * debian/rules:
    + Enable tests during package build. (Closes: #744403).

 -- Mike Gabriel <email address hidden>  Wed, 14 May 2014 10:19:23 +0200

0.5.4-1+deb7u1

Superseded in wheezy-release on 2016-04-02

libssh (0.5.4-1+deb7u1) wheezy-security; urgency=high


  * debian/patches/0004-security-fix-for-vulnerability-CVE-2014-0017.patch:
    Reset the PRNG state after accepting a new connection (CVE-2014-0017)

 -- Laurent Bigonville <email address hidden>  Wed, 05 Mar 2014 23:17:07 +0100

0.5.4-3

Superseded in jessie-release on 2014-05-20

Superseded in sid-release on 2014-05-15

libssh (0.5.4-3) unstable; urgency=high


  [ Mike Gabriel ]
  * debian/rules:
    + Add get-orig-source rule.
  * debian/watch:
    + Handle tar.gz and tar.xz upstream tarballs alike.
  * debian/copyright.in:
    + Ship auto-generated copyright file in debian/ folder.

  [ Laurent Bigonville ]
  * debian/patches/0007-security-fix-for-vulnerability-CVE-2014-0017.patch:
    Reset the PRNG state after acception a new connection (CVE-2014-0017)

 -- Laurent Bigonville <email address hidden>  Wed, 05 Mar 2014 22:42:19 +0100

0.6.3-1~exp1

Deleted in experimental-release (Reason: None provided.)

libssh (0.6.3-1~exp1) experimental; urgency=medium


  * New upstream release.
    - debian/patches/0007-security-fix-for-vulnerability-CVE-2014-0017.patch:
      Reset the PRNG state after acception a new connection (CVE-2014-0017)

 -- Laurent Bigonville <email address hidden>  Wed, 05 Mar 2014 23:02:10 +0100

0.6.1-1~exp1

Superseded in experimental-release on 2014-03-09

libssh (0.6.1-1~exp1) experimental; urgency=low


  * New upstream release.
  * debian/control:
    + Bump Standards: to 3.9.5. No changes needed.
  * debian/patches:
    + Remove obsolete patches (all applied upstream).
    + Add patch for fixing typos in upstream error messages.
  * Provide upstream signing key in package.
  * Update debian/libssh-4.symbols file.
  * Update debian/copyright.in file.
  * Update debian/copyright file.

 -- Mike Gabriel <email address hidden>  Wed, 19 Feb 2014 12:54:32 +0100

0.5.4-2

Superseded in jessie-release on 2014-03-08

Superseded in sid-release on 2014-03-06

libssh (0.5.4-2) unstable; urgency=low


  * debian/control:
    + Add myself to Uploaders: field as discussed with current
      maintainer on IRC (#debian-devel) on 2014-02-17.
    + Alioth-canonicalize Vcs-* fields.
  * debian/copyright:
    + Make copyright file DEP-5 compliant.
    + Relicense debian/* files under all licenses used by upstream.
      Copyright holders' agreements can be found in the related
      bug report in Debian BTS. (Closes: #739372).
  * debian/patches:
    + Add patch 0004-reset-global-request-status.patch: Allow requesting
      more than one channel per session.
    + Add patch 0005-multi-reverse-fwd.patch: Ease handling of multiple
      reverse port forwarding requests per session. (Closes: #736231).
    + Add patch 0006-ssh-handle-package-zero-timeouts.patch: Handle
      zero timeouts as such. Improves speed on libssh issued
      connections. (Closes: #738667).
  * Update libssh-4.symbols file with new symbol introduced by patch
    0005-multi-reverse-fwd.patch.

 -- Mike Gabriel <email address hidden>  Tue, 18 Feb 2014 13:34:13 +0100

0.4.5-3+squeeze1

Superseded in squeeze-release on 2014-07-19

libssh (0.4.5-3+squeeze1) stable-security; urgency=high


  * Stable security update: Fix possible denial of service and code
    execution via buffer overflows and double frees (CVE-2012-4559,
    CVE-2012-4561, CVE-2012-4562)

 -- Laurent Bigonville <email address hidden>  Thu, 29 Nov 2012 23:38:23 +0100

0.5.4-1

Superseded in jessie-release on 2014-03-01

Superseded in wheezy-release on 2014-04-26

Superseded in sid-release on 2014-02-19

libssh (0.5.4-1) unstable; urgency=low


  * New upstream security release
    - Fix NULL dereference leads to denial of service
      (Closes: #698963, CVE-2013-0176)
  * debian/patches/0003-fix-typo.patch: Fix typo in error message

 -- Laurent Bigonville <email address hidden>  Tue, 05 Feb 2013 01:06:40 +0100

Available diffs

diff from 0.5.3-1ubuntu1 (in Ubuntu) to 0.5.4-1 (34.4 KiB)

0.5.3-1

Superseded in wheezy-release on 2013-02-20

Superseded in sid-release on 2013-02-05

libssh (0.5.3-1) unstable; urgency=high


  * New upstream security release
    - Fixes CVE-2012-4559, CVE-2012-4560, CVE-2012-4561, CVE-2012-4562
    - Fix regression in pre-connected socket setting (Closes: #688700)

 -- Laurent Bigonville <email address hidden>  Wed, 21 Nov 2012 13:53:14 +0100

Available diffs

diff from 0.5.2-1build1 (in Ubuntu) to 0.5.3-1 (46.0 KiB)

0.5.2-1

Superseded in wheezy-release on 2012-11-24

Superseded in sid-release on 2012-11-21

libssh (0.5.2-1) unstable; urgency=low


  * New upstream release
    - Fix bug with ssh_channel_write (Closes: #631950)
  * debian/watch: Use new tarball location

 -- Laurent Bigonville <email address hidden>  Mon, 19 Sep 2011 12:01:26 +0200

0.5.1-1

Superseded in wheezy-release on 2011-09-30

Superseded in sid-release on 2011-09-22

libssh (0.5.1-1) unstable; urgency=low


  * New upstream release (Closes: #637445)
  * debian/patches/0001-rename-threads-static.patch,
    debian/patches/0002-Check-for-NULL-pointers-in-string-c.patch: Dropped
  * debian/rules:
    - Adjust rule that build documentation
  * debian/patches/0001-disable-latex-documentation.patch: Disable LaTeX
    documentation generation (Closes: #622108)
  * debian/control: Drop texlive-fonts-recommended build-dependency
  * debian/patches/0002-fix-html-doc-generation.patch: Fix HTML doc generation
    (LP: #821437)
  * debian/libssh-doc.doc-base: Refine Title and Files glob

 -- Laurent Bigonville <email address hidden>  Fri, 19 Aug 2011 00:46:48 +0200

0.5.0-2

Superseded in wheezy-release on 2011-09-21

Superseded in sid-release on 2011-09-20

libssh (0.5.0-2) unstable; urgency=low
  * debian/patches/0002-Check-for-NULL-pointers-in-string-c.patch:    Consolidate patch (Should fix previous REJECT)  * Support multiarch spec -- Laurent Bigonville <email address hidden>  Wed, 15 Jun 2011 15:48:07 +0200

0.4.8-2

Superseded in wheezy-release on 2011-09-21

Superseded in sid-release on 2011-09-20

libssh (0.4.8-2) unstable; urgency=low
  * Upload to unstable  * debian/control: Add texlive-fonts-recommended to Build-Depends-Indep    (Closes: #608319) -- Laurent Bigonville <email address hidden>  Sun, 13 Mar 2011 22:06:00 +0100

0.4.8-1

Deleted in experimental-release (Reason: None provided.)

libssh (0.4.8-1) experimental; urgency=low
  * New upstream release  * Bump debhelper compatibility to 8 -- Laurent Bigonville <email address hidden>  Mon, 17 Jan 2011 19:31:47 +0100

0.4.7-1

Superseded in experimental-release on 2011-09-21

libssh (0.4.7-1) experimental; urgency=low
  * New upstream release    - Drop all patches, applied upstream  * debian/watch: Fix URL regex -- Laurent Bigonville <email address hidden>  Tue, 04 Jan 2011 21:24:34 +0100

0.4.6-1

Superseded in experimental-release on 2011-09-21

libssh (0.4.6-1) experimental; urgency=low
  * New upstream release -- Laurent Bigonville <email address hidden>  Mon, 13 Dec 2010 23:30:03 +0100

0.4.5-3

Superseded in wheezy-release on 2011-09-21

Superseded in squeeze-release on 2013-02-23

Superseded in sid-release on 2011-09-20

libssh (0.4.5-3) unstable; urgency=low
  * d/p/0002-socket-Fixed-uninitialized-fd-revents-member.patch:    Fix uninitialized memory use (Closes: #606347) -- Laurent Bigonville <email address hidden>  Sat, 11 Dec 2010 01:33:45 +0100

0.4.5-2

Superseded in squeeze-release on 2011-09-13

Superseded in sid-release on 2011-09-20

libssh (0.4.5-2) unstable; urgency=low


  * Add d/p/0001-socket.c-Fixed-setting-max_fd-which-breaks-ssh_selec.patch:
    Fix slow response in Remmina SSH (Closes: #599687, LP: #663777)
  * debian/control: Bump Standards-Version to 3.9.1 (no futher changes)
  * debian/copyright: Update copyright file to please lintian

 -- Laurent Bigonville <email address hidden>  Wed, 20 Oct 2010 20:45:48 +0200

0.4.5-1

Superseded in squeeze-release on 2011-09-13

Superseded in sid-release on 2011-09-20

libssh (0.4.5-1) unstable; urgency=low


  * New upstream release
  * Bump Standards-Version to 3.9.0 (no further changes)
  * Move doxygen to Build-Depends-Indep

 -- Laurent Bigonville <email address hidden>  Sun, 18 Jul 2010 22:48:10 +0200

0.4.4-1

Superseded in squeeze-release on 2011-09-13

Superseded in sid-release on 2011-09-20

libssh (0.4.4-1) unstable; urgency=low


  * New upstream release
    - Should fix ~/.ssh directory access (Closes: #582461)

 -- Laurent Bigonville <email address hidden>  Mon, 31 May 2010 20:10:56 +0200

0.4.3-1

Superseded in sid-release on 2011-09-20

libssh (0.4.3-1) unstable; urgency=low


  * New upstream release
    - Drop 0001-Fix-symbols-visibility.patch, applyed upstream
    - Update debian/libssh-4.symbols: Add new symbol

 -- Laurent Bigonville <email address hidden>  Tue, 18 May 2010 21:06:33 +0200

0.4.2-1

Superseded in squeeze-release on 2011-09-13

Superseded in sid-release on 2011-09-20

libssh (0.4.2-1) unstable; urgency=low


  * New upstream release
    - 0001-Fix-symbols-visibility.patch: Only export needed symbols
    - debian/libssh-4.symbols: Update symbols file

 -- Laurent Bigonville <email address hidden>  Thu, 25 Mar 2010 13:38:35 +0100

0.4.1-1

Superseded in squeeze-release on 2011-09-13

Superseded in sid-release on 2011-09-20

libssh (0.4.1-1) unstable; urgency=low


  * New upstream release
  * debian/control: Bump Standards-Version (no further changes)
  * Use new source package format '3.0 (quilt)'

 -- Laurent Bigonville <email address hidden>  Sat, 13 Feb 2010 20:18:18 +0100

0.4.0-1

Superseded in squeeze-release on 2011-09-13

Superseded in sid-release on 2011-09-20

libssh (0.4.0-1) unstable; urgency=low


  * New upstream release.
    - Bump soname
    - Adjust .symbols file
  * Readd static library in -dev package
  * Let dh_lintian install override file
  * debian/README.Debian: Update file
  * debian/rules: Add list-missing rule

 -- Laurent Bigonville <email address hidden>  Sat, 12 Dec 2009 14:29:12 +0100

0.3.4-3

Superseded in squeeze-release on 2011-09-13

Superseded in sid-release on 2011-09-20

libssh (0.3.4-3) unstable; urgency=low


  * Add correct Conflicts/Replaces for -dev and -doc packages
    (Closes: #550996)

 -- Laurent Bigonville <email address hidden>  Thu, 15 Oct 2009 09:59:57 +0200

0.3.4-2

Superseded in sid-release on 2011-09-20

libssh (0.3.4-2) unstable; urgency=low


  * debian/watch: Update the URL
  * debian/copyright: Add missing licence for some cmake/Modules files

 -- Laurent Bigonville <email address hidden>  Mon, 12 Oct 2009 09:37:03 +0200

0.2+svn20070321-4

Superseded in squeeze-release on 2011-09-13

Superseded in sid-release on 2011-09-20

Published in lenny-release on 2008-10-29

libssh (0.2+svn20070321-4) unstable; urgency=low


  * debian/control:
    - Add XS-Vcs-Svn and XS-Vcs-Browser fields.
    - Change to ${binary:Version} for versionized dependencies.
  * Add debian/README.Debian to disambiguate the package name 

 -- Laurent Bigonville <email address hidden>  Fri, 27 Jul 2007 15:00:06 +0200

Debian
libssh package

Change log for libssh package in Debian

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Debianlibssh package

Change log for libssh package in Debian

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Debian
libssh package