Change logs for libssh source package in Bionic

libssh (0.8.0~20170825.94fa1e38-1ubuntu0.7) bionic-security; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2020-16135-*.patch: fix a NULL dereference
      checking the return of ssh_buffer_new() and added others checks
      in src/sftpservcer.c, src/buffer.c.
    - CVE-2020-16135

 -- <email address hidden> (Leonidas S. Barbosa)  Fri, 31 Jul 2020 15:46:18 -0300

libssh (0.8.0~20170825.94fa1e38-1ubuntu0.6) bionic-security; urgency=medium

  * SECURITY UPDATE: denial of service via AES-CTR ciphers
    - debian/patches/CVE-2020-1730.patch: fix a possible segfault when
      zeroing AES-CTR key in src/libcrypto.c.
    - CVE-2020-1730

 -- Marc Deslauriers <email address hidden>  Tue, 07 Apr 2020 13:16:14 -0400

libssh (0.8.0~20170825.94fa1e38-1ubuntu0.5) bionic-security; urgency=medium

  * SECURITY UPDATE: unsanitized location in scp could lead to unwanted
    command execution
    - debian/patches/CVE-2019-14889-1.patch: reformat code in scp/scp.c.
    - debian/patches/CVE-2019-14889-2.patch: log SCP warnings received from
      the server in src/scp.c.
    - debian/patches/CVE-2019-14889-3.patch: add function to quote file
      names in include/libssh/misc.h, src/misc.c.
    - debian/patches/CVE-2019-14889-4.patch: don't allow file path longer
      than 32kb in src/scp.c.
    - debian/patches/CVE-2019-14889-5.patch: quote location to be used on
      shell in src/scp.c.
    - CVE-2019-14889

 -- Marc Deslauriers <email address hidden>  Tue, 10 Dec 2019 10:30:36 -0500

libssh (0.8.0~20170825.94fa1e38-1ubuntu0.2) bionic-security; urgency=medium

  * SECURITY REGRESSION: fix multiple regressions (LP: #1805348)
    - debian/patches/CVE-2018-10933-regression.patch: set correct state
      after sending INFO_REQUEST in src/server.c.
    - debian/patches/CVE-2018-10933-regression2.patch: add missing break in
      src/packet.c.
    - debian/patches/CVE-2018-10933-regression3.patch: set correct state
      after sending GSSAPI_RESPONSE in src/gssapi.c.

 -- Marc Deslauriers <email address hidden>  Tue, 27 Nov 2018 10:01:15 -0500

libssh (0.8.0~20170825.94fa1e38-1ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: authentication bypass vulnerability
    - debian/patches/CVE-2018-10933-*.patch: add upstream patches to
      correct the issue.
    - CVE-2018-10933

 -- Marc Deslauriers <email address hidden>  Tue, 16 Oct 2018 14:26:47 -0400

libssh (0.8.0~20170825.94fa1e38-1build1) bionic; urgency=high

  * No change rebuild against openssl1.1.

 -- Dimitri John Ledkov <email address hidden>  Wed, 07 Feb 2018 11:35:23 +0000

libssh (0.8.0~20170825.94fa1e38-1) unstable; urgency=medium

  [ Laurent Bigonville ]
  * debian/watch: Verify the signature of the upstream tarball
  * debian/libssh-gcrypt-4.lintian-overrides: Adjust the overrides

  [ Matteo F. Vescovi ]
  * New upstream git snapshot (based on commit 94fa1e38) (Closes: #828413)
  * debian/patches/: patchset refreshed against snapshot release
  * debian/: symbols files refreshed for snapshot release
  * debian/control: bump OpenSSL b-dep to use 1.1 version
  * debian/copyright: entried updated
  * debian/copyright.in: drop useless file
  * debian/patches/: patchset updated
    - 2004-fix-upstream-version.patch added

 -- Laurent Bigonville <email address hidden>  Wed, 13 Sep 2017 14:36:14 +0200

libssh (0.7.5-1) unstable; urgency=medium

  * New upstream release.
  * debian/control: Bump Standards-Version to 4.0.0 (no further changes)
  * debian/libssh-gcrypt-4.lintian-overrides: Adjust library soname to the new
    release

 -- Laurent Bigonville <email address hidden>  Mon, 03 Jul 2017 15:29:04 +0200