Change log for libapache2-mod-auth-openidc package in Ubuntu

libapache2-mod-auth-openidc (2.4.15.1-1build3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <email address hidden>  Sun, 31 Mar 2024 18:44:59 +0000

Available diffs

• diff from 2.4.15.1-1build2 to 2.4.15.1-1build3 (351 bytes)

libapache2-mod-auth-openidc (2.4.15.1-1build2) noble; urgency=medium

  * No-change rebuild against libcurl4t64

 -- Steve Langasek <email address hidden>  Sat, 16 Mar 2024 06:30:28 +0000

Available diffs

• diff from 2.4.15.1-1 (in Debian) to 2.4.15.1-1build2 (597 bytes)
• diff from 2.4.15.1-1build1 to 2.4.15.1-1build2 (342 bytes)

libapache2-mod-auth-openidc (2.4.15.1-1build1) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <email address hidden>  Mon, 04 Mar 2024 18:20:35 +0000

Available diffs

• diff from 2.4.15.1-1 (in Debian) to 2.4.15.1-1build1 (568 bytes)

libapache2-mod-auth-openidc (2.4.15.1-1) unstable; urgency=medium

  * New upstream version 2.4.15.1
  * Add d/NEWS entry for 2.4.15

 -- Moritz Schlarb <email address hidden>  Thu, 01 Feb 2024 21:28:41 +0100

Available diffs

• diff from 2.4.14.4-2build1 (in Ubuntu) to 2.4.15.1-1 (245.6 KiB)

libapache2-mod-auth-openidc (2.4.14.4-2build1) noble; urgency=medium

  * No-change rebuild against libhiredis1.1.0

 -- Dan Bungert <email address hidden>  Wed, 24 Jan 2024 08:28:41 -0700

Available diffs

• diff from 2.4.14.4-2 (in Debian) to 2.4.14.4-2build1 (365 bytes)

libapache2-mod-auth-openidc (2.4.14.4-2) unstable; urgency=medium

  * Add d/clean (Closes: #1048824)

 -- Moritz Schlarb <email address hidden>  Tue, 12 Dec 2023 10:50:27 +0100

Available diffs

• diff from 2.4.14.2-1 to 2.4.14.4-2 (26.6 KiB)

libapache2-mod-auth-openidc (2.4.14.2-1) unstable; urgency=medium

  * New upstream version 2.4.14.2
  * Refresh patches

 -- Moritz Schlarb <email address hidden>  Fri, 30 Jun 2023 12:05:34 +0200

Available diffs

• diff from 2.4.12.3-2 to 2.4.14.2-1 (111.3 KiB)

libapache2-mod-auth-openidc (2.4.12.3-2) unstable; urgency=high

  * Add patch to Fix CVE-2023-28625 (Closes: #1033916)
    segfault DoS when OIDCStripCookies is set
    https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr

 -- Moritz Schlarb <email address hidden>  Tue, 02 May 2023 11:48:09 +0200

Available diffs

• diff from 2.4.12.3-1 to 2.4.12.3-2 (959 bytes)

libapache2-mod-auth-openidc (2.4.12.3-1) unstable; urgency=medium

  * New upstream version 2.4.12.3
  * Bump Standards-Version

 -- Moritz Schlarb <email address hidden>  Thu, 16 Feb 2023 14:20:20 +0100

Available diffs

• diff from 2.4.12.2-1 to 2.4.12.3-1 (7.2 KiB)

libapache2-mod-auth-openidc (2.4.12.2-1) unstable; urgency=medium

  * New upstream version 2.4.12.2
    Fixes CVE-2022-23527
  * Set Architecture: any (Closes: #1024978)

 -- Moritz Schlarb <email address hidden>  Wed, 14 Dec 2022 14:58:17 +0100

Available diffs

• diff from 2.4.12.1-1 to 2.4.12.2-1 (4.2 KiB)
• diff from 2.4.12.1-2 to 2.4.12.2-1 (4.0 KiB)

libapache2-mod-auth-openidc (2.4.12.1-2) sid; urgency=medium

  * Change gbp debian-branch
  * Set Architecture: any (Closes: #1024978)

 -- Moritz Schlarb <email address hidden>  Wed, 14 Dec 2022 10:32:01 +0100

Available diffs

• diff from 2.4.12.1-1 to 2.4.12.1-2 (727 bytes)

libapache2-mod-auth-openidc (2.4.12.1-1) unstable; urgency=medium

  * New upstream version 2.4.12.1

 -- Moritz Schlarb <email address hidden>  Thu, 24 Nov 2022 14:40:51 +0100

Available diffs

• diff from 2.4.12-1 to 2.4.12.1-1 (18.8 KiB)

libapache2-mod-auth-openidc (2.4.12-1) unstable; urgency=medium

  * New upstream version 2.4.12

    Release 2.4.12 was (re-)certified for all OpenID Connect Relying Party
    conformance profiles using the OpenID Foundation's certification suite:
    https://openid.net/certification/#RPs.

    * Features

     * allow storing the id_token in a client-cookie based session so that it
       can be used as id_token_hint value in a logout request later;
     * allow setting connection pool parameters for Memcache server connections
     * add option to set a username for Redis >= 6.x ACL authentication via
       OIDCRedisCacheUsername
     * register request_object_signing_alg in dynamic client registration when
       using request_uri

    * Bugfixes

     * increase size of the output buffer when using libpcre2 for substitution
     * support OIDCSessionInactivityTimeout values greater than 30 days when
       using Memcache
     * allow for step-up discovery with an external URL using HTML refresh;
       fixes behaviour on CentOS 7/8 when combined with ProxyPass
     * apply exact length matching for at_hash and c_hash validation
     * store access token obtained from backchannel in session over the one
       returned in the frontchannel for code token and code id_token token flows
     * check ID token signed response algorithm on backchannel logout_token and
       retrieve its configuration value from the client metadata file

 -- Moritz Schlarb <email address hidden>  Tue, 18 Oct 2022 09:50:00 +0200

Available diffs

• diff from 2.4.11.2-1 to 2.4.12-1 (17.1 KiB)

libapache2-mod-auth-openidc (2.4.11.2-1) unstable; urgency=medium

  * New upstream version 2.4.11.2

 -- Moritz Schlarb <email address hidden>  Wed, 08 Jun 2022 12:45:43 +0200

Available diffs

• diff from 2.4.11.1-1 to 2.4.11.2-1 (3.7 KiB)

libapache2-mod-auth-openidc (2.4.11.1-1) unstable; urgency=medium

  * New upstream version 2.4.11.1

 -- Moritz Schlarb <email address hidden>  Thu, 31 Mar 2022 12:06:07 +0200

Available diffs

• diff from 2.4.11-1 to 2.4.11.1-1 (15.8 KiB)

libapache2-mod-auth-openidc (2.4.11-1) unstable; urgency=medium

  * Set upstream metadata fields: Security-Contact.
  * New upstream version 2.4.11

 -- Moritz Schlarb <email address hidden>  Wed, 23 Feb 2022 09:52:29 +0100

Available diffs

• diff from 2.4.10-1build1 (in Ubuntu) to 2.4.11-1 (27.6 KiB)

libapache2-mod-auth-openidc (2.4.10-1build1) jammy; urgency=medium

  * No-change rebuild against libssl3

 -- Steve Langasek <email address hidden>  Wed, 08 Dec 2021 23:36:19 +0000

Available diffs

• diff from 2.4.10-1 (in Debian) to 2.4.10-1build1 (572 bytes)

libapache2-mod-auth-openidc (2.4.10-1) unstable; urgency=medium

  * Drop patches (included upstream)
  * Update module path to built library

 -- Moritz Schlarb <email address hidden>  Tue, 16 Nov 2021 10:13:53 +0100

Available diffs

• diff from 2.4.9.4-1 to 2.4.10-1 (23.2 KiB)

libapache2-mod-auth-openidc (2.4.9.4-1) unstable; urgency=medium

  * New upstream version 2.4.9.4
  * Fix "CVE-2021-39191" (Closes: #993648)
  * 2.4.9.2 fixed a regression regarding segfault at reload/restart
    (Closes: #883616, #891224, #868949)

 -- Moritz Schlarb <email address hidden>  Tue, 07 Sep 2021 09:37:15 +0200

Available diffs

• diff from 2.4.9-1 to 2.4.9.4-1 (7.8 KiB)

libapache2-mod-auth-openidc (2.4.9-1) unstable; urgency=medium

  * New upstream version 2.4.9
  * Fix for CVE-2021-32792 (closes: #991580)
  * Fix for CVE-2021-32791 (closes: #991581)
  * Fix for CVE-2021-32786 (closes: #991582)
  * Fix for CVE-2021-32785 (closes: #991583)

 -- Christoph Martin <email address hidden>  Mon, 02 Aug 2021 11:45:39 +0200

Available diffs

• diff from 2.4.4.1-2 to 2.4.9-1 (67.5 KiB)

libapache2-mod-auth-openidc (2.4.4.1-2) unstable; urgency=medium

  * fix CVE-2021-20718 using commit
    5ef1b0a74208fcb43a16795d0afc94c3d54cd120 from version 2.4.8 (closes:
    #989055)

 -- Christoph Martin <email address hidden>  Mon, 07 Jun 2021 20:54:00 +0200

Available diffs

• diff from 2.4.4.1-1 to 2.4.4.1-2 (1.2 KiB)

libapache2-mod-auth-openidc (2.4.4.1-1) unstable; urgency=medium

  [ Debian Janitor ]
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository,
    Repository-Browse.

  [ Moritz Schlarb ]
  * Move upstream URLs to new name
  * New upstream version 2.4.4.1
  * Bump dh-compat
  * Fix d/copyright
  * Remove removed lintian override
    apache2-module-depends-on-real-apache2-package

 -- Moritz Schlarb <email address hidden>  Thu, 12 Nov 2020 09:25:40 +0100

Available diffs

• diff from 2.4.3-1 to 2.4.4.1-1 (13.4 KiB)

libapache2-mod-auth-openidc (2.4.3-1) unstable; urgency=medium

  * New upstream version 2.4.3

 -- Moritz Schlarb <email address hidden>  Thu, 18 Jun 2020 12:54:41 +0200

Available diffs

• diff from 2.4.1-1 to 2.4.3-1 (18.8 KiB)

libapache2-mod-auth-openidc (2.4.1-1) unstable; urgency=medium

  * New upstream version 2.4.1
  * Bump Standards-Version and use declarative debhelper

 -- Moritz Schlarb <email address hidden>  Thu, 13 Feb 2020 12:07:30 +0100

Available diffs

• diff from 2.4.0.4-1 to 2.4.1-1 (13.3 KiB)

libapache2-mod-auth-openidc (2.4.0.4-1) unstable; urgency=medium

  * New upstream version 2.4.0.4
  * Update Standards-Version

 -- Moritz Schlarb <email address hidden>  Tue, 12 Nov 2019 10:45:51 +0100

Available diffs

• diff from 2.3.10.2-1 to 2.4.0.4-1 (78.6 KiB)
• diff from 2.4.0.3-1 to 2.4.0.4-1 (1.6 KiB)

libapache2-mod-auth-openidc (2.4.0.3-1) unstable; urgency=high

  * Update watch file to use Github tag archives
  * New upstream version 2.4.0.3
    (Closes: #942165)

 -- Moritz Schlarb <email address hidden>  Wed, 16 Oct 2019 10:13:44 +0200

libapache2-mod-auth-openidc (2.3.10.2-1) unstable; urgency=medium

  * New upstream version 2.3.10.2

 -- Moritz Schlarb <email address hidden>  Tue, 29 Jan 2019 21:40:30 +0100

Available diffs

• diff from 2.3.10-1 to 2.3.10.2-1 (3.7 KiB)

libapache2-mod-auth-openidc (2.3.10-1) unstable; urgency=medium

  [ Frédéric Bonnard ]
  * Fix parallel build (Closes: #913631)

  [ Moritz Schlarb ]
  * Update Maintainer and Standards-Version fields
  * New upstream version 2.3.10

 -- Moritz Schlarb <email address hidden>  Wed, 02 Jan 2019 14:58:25 +0100

Available diffs

• diff from 2.3.7-1build1 (in Ubuntu) to 2.3.10-1 (41.3 KiB)
• diff from 2.3.8-1build1 (in Ubuntu) to 2.3.10-1 (26.5 KiB)

libapache2-mod-auth-openidc (2.3.7-1build1) disco; urgency=medium

  * No-change rebuild against libhiredis0.14

 -- Steve Langasek <email address hidden>  Wed, 14 Nov 2018 15:47:22 -0800

Available diffs

• diff from 2.3.7-1 (in Debian) to 2.3.7-1build1 (350 bytes)
• diff from 2.3.8-1build1 to 2.3.7-1build1 (20.3 KiB)

libapache2-mod-auth-openidc (2.3.8-1build1) disco; urgency=medium

  * No-change rebuild against libhiredis0.14

 -- Steve Langasek <email address hidden>  Mon, 12 Nov 2018 08:47:19 +0000

Available diffs

• diff from 2.3.8-1 (in Debian) to 2.3.8-1build1 (623 bytes)

libapache2-mod-auth-openidc (2.3.8-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/copyright: Use https protocol in Format field
  * d/changelog: Remove trailing whitespaces

  [ Moritz Schlarb ]
  * Update Standards-Version
  * New upstream version 2.3.8

 -- Moritz Schlarb <email address hidden>  Fri, 09 Nov 2018 09:43:22 +0100

libapache2-mod-auth-openidc (2.3.7-1) unstable; urgency=medium

  * New upstream version 2.3.7
  * Move Vcs-* to Salsa

 -- Moritz Schlarb <email address hidden>  Mon, 06 Aug 2018 16:05:03 +0200

Available diffs

• diff from 2.3.3-1build1 (in Ubuntu) to 2.3.7-1 (24.6 KiB)

libapache2-mod-auth-openidc (2.3.3-1build1) bionic; urgency=medium

  * No-change rebuild against libcurl4

 -- Steve Langasek <email address hidden>  Wed, 28 Feb 2018 07:03:53 +0000

Available diffs

• diff from 2.3.2-1build1 to 2.3.3-1build1 (15.1 KiB)
• diff from 2.3.3-1 (in Debian) to 2.3.3-1build1 (623 bytes)

libapache2-mod-auth-openidc (2.3.3-1) unstable; urgency=medium

  * New upstream version 2.3.3
  * Update debian/control

 -- Moritz Schlarb <email address hidden>  Tue, 20 Feb 2018 12:27:15 +0100

Available diffs

• diff from 2.3.2-1build1 (in Ubuntu) to 2.3.3-1 (15.0 KiB)

libapache2-mod-auth-openidc (2.3.2-1build1) bionic; urgency=high

  * No change rebuild against openssl1.1.

 -- Dimitri John Ledkov <email address hidden>  Mon, 05 Feb 2018 23:22:22 +0000

Available diffs

• diff from 2.3.2-1 (in Debian) to 2.3.2-1build1 (643 bytes)

libapache2-mod-auth-openidc (2.3.2-1) unstable; urgency=medium

  * New upstream version 2.3.2
  * link against openssl 1.1 (closes: #858993)

 -- Christoph Martin <email address hidden>  Tue, 14 Nov 2017 12:14:22 +0100

Available diffs

• diff from 2.3.1-2 to 2.3.2-1 (20.3 KiB)

libapache2-mod-auth-openidc (2.3.1-2) unstable; urgency=medium

  * Fix maintainer script generation to enable/disable the module on
    installation and removal. This is safe to do because the example
    configuration does not do anything.
    This also closes: #868949 since it actually restarts Apache2 after
    enabling the module.

 -- Moritz Schlarb <email address hidden>  Tue, 08 Aug 2017 09:31:43 +0200

Available diffs

• diff from 2.1.6-1 to 2.3.1-2 (134.7 KiB)

libapache2-mod-auth-openidc (2.1.6-1) unstable; urgency=high

  * New upstream version 2.1.6
    "This is a security release:
    Those using AuthType oauth20 together with applications that interpret
    headers set by mod_auth_openidc on paths that disclose sensitive
    information are affected and should upgrade."

 -- Moritz Schlarb <email address hidden>  Thu, 23 Feb 2017 13:33:55 +0100

Available diffs

• diff from 2.1.5-1 to 2.1.6-1 (6.0 KiB)

libapache2-mod-auth-openidc (2.1.5-1) unstable; urgency=high

  * Imported Upstream version 2.1.5
    fixes two security issues:
    https://github.com/pingidentity/mod_auth_openidc/issues/212
    https://github.com/pingidentity/mod_auth_openidc/issues/222

 -- Christoph Martin <email address hidden>  Mon, 06 Feb 2017 10:56:03 +0100

Available diffs

• diff from 1.8.10.1-1.2 to 2.1.5-1 (123.5 KiB)
• diff from 2.1.3-1 to 2.1.5-1 (8.8 KiB)

libapache2-mod-auth-openidc (2.1.3-1) unstable; urgency=medium

  * Fix watch file
  * New upstream version 2.1.3
  * Fix lintian warning:
    apache2-module-depends-on-real-apache2-package

 -- Moritz Schlarb <email address hidden>  Fri, 13 Jan 2017 15:52:26 +0100

Available diffs

• diff from 2.1.2-2 to 2.1.3-1 (3.1 KiB)

libapache2-mod-auth-openidc (2.1.2-2) unstable; urgency=medium

  * new upload excluding archs which don't build

 -- Christoph Martin <email address hidden>  Mon, 09 Jan 2017 11:59:21 +0100

Available diffs

• diff from 2.1.2-1 to 2.1.2-2 (607 bytes)

libapache2-mod-auth-openidc (2.1.2-1) unstable; urgency=medium

  * add Vcs Tags to control
  * Imported Upstream version 2.1.2

 -- Christoph Martin <email address hidden>  Fri, 09 Dec 2016 09:57:49 +0100

Available diffs

• diff from 1.8.10.1-1.2 to 2.1.2-1 (118.6 KiB)

libapache2-mod-auth-openidc (1.8.10.1-1.2) unstable; urgency=medium

  * NMU: change depends to libssl1.0 to make it build again with apache
    (closes: # 844803)

 -- Christoph Martin <email address hidden>  Tue, 22 Nov 2016 09:46:30 +0100

Available diffs

• diff from 1.8.10.1-1.1 to 1.8.10.1-1.2 (732 bytes)

libapache2-mod-auth-openidc (1.8.10.1-1.1) unstable; urgency=medium

  * NMU: fix watch file

 -- Christoph Martin <email address hidden>  Thu, 10 Nov 2016 11:41:35 +0100

Available diffs

• diff from 1.8.10.1-1 to 1.8.10.1-1.1 (3.2 KiB)

libapache2-mod-auth-openidc (1.8.10.1-1) unstable; urgency=medium

  * fix Elliptic Curve signature verification

 -- Hans Zandbelt <email address hidden>  Mon, 11 Jul 2016 15:12:50 +0200

Available diffs

• diff from 1.8.8-1 to 1.8.10.1-1 (17.1 KiB)

libapache2-mod-auth-openidc (1.8.8-1) unstable; urgency=medium

  * pass bearer token in alternative ways

 -- Hans Zandbelt <email address hidden>  Thu, 10 Mar 2016 12:22:38 +0100

Available diffs

• diff from 1.8.5-1 to 1.8.8-1 (30.3 KiB)

libapache2-mod-auth-openidc (1.8.5-1) unstable; urgency=medium

  * HTTP-based logout

 -- Hans Zandbelt <email address hidden>  Mon, 21 Sep 2015 08:59:17 +0200

Available diffs

• diff from 1.6.0-1 to 1.8.5-1 (117.5 KiB)

libapache2-mod-auth-openidc (1.6.0-1) unstable; urgency=medium


  * new upstream release; add libssl-dev dependency

 -- Hans Zandbelt <email address hidden>  Mon, 13 Oct 2014 12:23:35 +0200

Available diffs

• diff from 1.5.1-1 to 1.6.0-1 (77.3 KiB)
• diff from 1.5.3-1 to 1.6.0-1 (65.8 KiB)

libapache2-mod-auth-openidc (1.5.3-1) unstable; urgency=medium


  * fix initialization leak

 -- Hans Zandbelt <email address hidden>  Fri, 1 Aug 2014 12:37:53 +0200

Available diffs

• diff from 1.5.1-1 to 1.5.3-1 (23.3 KiB)

libapache2-mod-auth-openidc (1.5.1-1) unstable; urgency=medium


  * add pkg-config to Build-Depends

 -- Hans Zandbelt <email address hidden>  Thu, 12 Jun 2014 14:33:10 +0200