diff -pruN 8.14.1-1/debian/changelog 8.14.1-1ubuntu3/debian/changelog --- 8.14.1-1/debian/changelog 2025-06-04 07:21:05.000000000 +0000 +++ 8.14.1-1ubuntu3/debian/changelog 2025-08-28 19:13:38.000000000 +0000 @@ -1,3 +1,26 @@ +curl (8.14.1-1ubuntu3) questing; urgency=medium + + * Rebuild to include updated RISC-V base ISA RVA23 + + -- Heinrich Schuchardt Thu, 28 Aug 2025 19:13:38 +0000 + +curl (8.14.1-1ubuntu2) questing; urgency=medium + + * Drop part of delta as it was merged upstream: + - d/rules: use libssh2-dev as it is in main (LP #2076865) + + -- Ural Tunaboyu Mon, 16 Jun 2025 12:40:58 -0700 + +curl (8.14.1-1ubuntu1) questing; urgency=medium + + * Merge with Debian unstable (LP: #2113994). Remaining changes: + - d/rules: use libssh2-dev as it is in main (LP #2076865) + - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe + - d/{control,rules}: do not use gnutls for the curl binary + - debian/control: don't build-depend on python3-impacket and stunnel4 on i386 + + -- Ural Tunaboyu Wed, 11 Jun 2025 13:36:53 -0700 + curl (8.14.1-1) unstable; urgency=medium * New upstream version 8.14.1 @@ -25,6 +48,16 @@ curl (8.14.0-1) unstable; urgency=medium -- Samuel Henrique Wed, 28 May 2025 19:26:28 +0100 +curl (8.13.0-5ubuntu1) questing; urgency=medium + + * Merge with Debian unstable (LP: #2111373). Remaining changes: + - d/rules: use libssh2-dev as it is in main (LP #2076865) + - d/{control,rules}: drop nghttp3 and ngtcp2 dependencies in universe + - d/{control,rules}: do not use gnutls for the curl binary + - debian/control: don't build-depend on python3-impacket and stunnel4 on i386 + + -- Ural Tunaboyu Sun, 18 May 2025 19:46:02 -0700 + curl (8.13.0-5) unstable; urgency=medium * d/t/upstream-*: ensure clean build by calling override_dh_auto_clean @@ -116,6 +149,17 @@ curl (8.13.0~rc2-1) unstable; urgency=me -- Samuel Henrique Mon, 17 Mar 2025 16:40:32 +0000 +curl (8.12.1-3ubuntu1) plucky; urgency=medium + + * Merge from Debian Unstable. Remaining changes: + - debian/control: Don't build-depend on python3-impacket and stunnel4 on + i386 so we can drop it (and its dependencies) from the i386 partial port. + - d/{control,rules}: Do not use gnutls for the curl binary. + - d/{control,rules}: Drop nghttp3 and ngtcp2 dependencies in Universe. + - d/rules: Use libssh2-dev as it is in Main (LP: #2076865). + + -- Simon Quigley Tue, 04 Mar 2025 20:32:39 -0600 + curl (8.12.1-3) unstable; urgency=medium [ Carlos Henrique Lima Melara ] @@ -126,6 +170,17 @@ curl (8.12.1-3) unstable; urgency=medium -- Samuel Henrique Tue, 25 Feb 2025 19:30:46 +0000 +curl (8.12.1-2ubuntu1) plucky; urgency=medium + + * Merge from Debian Unstable. Remaining changes: + - debian/control: Don't build-depend on python3-impacket and stunnel4 on + i386 so we can drop it (and its dependencies) from the i386 partial port. + - d/{control,rules}: Do not use gnutls for the curl binary. + - d/{control,rules}: Drop nghttp3 and ngtcp2 dependencies in Universe. + - d/rules: Use libssh2-dev as it is in Main (LP: #2076865). + + -- Simon Quigley Wed, 19 Feb 2025 02:06:13 -0600 + curl (8.12.1-2) unstable; urgency=medium * Revert "Use valgrind in tests" @@ -137,6 +192,27 @@ curl (8.12.1-2) unstable; urgency=medium -- Samuel Henrique Fri, 14 Feb 2025 21:27:50 +0000 +curl (8.12.1-1ubuntu2) plucky; urgency=medium + + * Disable valgrind on riscv64. + * Drop libcurl4-openssl-dev's runtime dependency on libnghttp3-dev in + Universe. + + -- Simon Quigley Tue, 18 Feb 2025 01:47:49 -0600 + +curl (8.12.1-1ubuntu1) plucky; urgency=medium + + * Merge from Debian Unstable. Remaining changes: + - debian/control: Don't build-depend on python3-impacket and stunnel4 on + i386 so we can drop it (and its dependencies) from the i386 partial port. + It's only used for the tests, which do not block the build in any case. + - d/{control,rules}: Do not use gnutls for the curl binary. + - d/{control,rules}: Drop nghttp3 & ngtcp2 depdendencies of + libcurl-gnutls to avoid component-mismatch. + - d/rules: Use libssh2-dev as it is in main (LP: #2076865). + + -- Simon Quigley Fri, 14 Feb 2025 21:43:29 -0600 + curl (8.12.1-1) unstable; urgency=medium * New upstream version 8.12.1. @@ -148,6 +224,19 @@ curl (8.12.1-1) unstable; urgency=medium -- Samuel Henrique Thu, 13 Feb 2025 22:17:23 +0000 +curl (8.12.0+git20250209.89ed161+ds-1ubuntu1) plucky; urgency=medium + + * Merge from Debian Unstable. Remaining changes: + - debian/control: Don't build-depend on python3-impacket and stunnel4 on + i386 so we can drop it (and its dependencies) from the i386 partial port. + It's only used for the tests, which do not block the build in any case. + - d/{control,rules}: Do not use gnutls for the curl binary. + - d/{control,rules}: Drop nghttp3 & ngtcp2 depdendencies of + libcurl-gnutls to avoid component-mismatch. + - d/rules: Use libssh2-dev as it is in main (LP: #2076865). + + -- Simon Quigley Mon, 10 Feb 2025 22:22:17 -0600 + curl (8.12.0+git20250209.89ed161+ds-1) unstable; urgency=medium [ Samuel Henrique ] @@ -163,6 +252,19 @@ curl (8.12.0+git20250209.89ed161+ds-1) u -- Carlos Henrique Lima Melara Sun, 09 Feb 2025 00:08:26 +0100 +curl (8.11.1-1ubuntu1) plucky; urgency=medium + + * Merge with Debian Unstable. Remaining changes: + - debian/control: Don't build-depend on python3-impacket and stunnel4 on + i386 so we can drop it (and its dependencies) from the i386 partial port. + It's only used for the tests, which do not block the build in any case. + - d/{control,rules}: Do not use gnutls for the curl binary. + - d/{control,rules}: Drop nghttp3 & ngtcp2 depdendencies of + libcurl-gnutls to avoid component-mismatch. + - d/rules: Use libssh2-dev as it is in main (LP: #2076865). + + -- Simon Quigley Sat, 14 Dec 2024 03:39:34 -0600 + curl (8.11.1-1) unstable; urgency=medium [ Samuel Henrique ] @@ -190,6 +292,25 @@ curl (8.11.1-1) unstable; urgency=medium -- Samuel Henrique Thu, 12 Dec 2024 21:38:04 +0000 +curl (8.11.0-1ubuntu2) plucky; urgency=medium + + * Update debian/rules to actually use libssh2 on Ubuntu + + -- Jeremy Bícha Fri, 22 Nov 2024 14:34:26 -0500 + +curl (8.11.0-1ubuntu1) plucky; urgency=medium + + * Merge with Debian Unstable. Remaining changes: + - debian/control: Don't build-depend on python3-impacket and stunnel4 on + i386 so we can drop it (and its dependencies) from the i386 partial port. + It's only used for the tests, which do not block the build in any case. + - d/{control,rules}: Do not use gnutls for the curl binary. + - d/{control,rules}: Drop nghttp3 & ngtcp2 depdendencies of + libcurl-gnutls to avoid component-mismatch. + - d/rules: Use libssh2-dev as it is in main (LP: #2076865). + + -- Simon Quigley Thu, 21 Nov 2024 15:44:22 -0600 + curl (8.11.0-1) unstable; urgency=medium [ Samuel Henrique ] @@ -254,6 +375,41 @@ curl (8.10.0-1) unstable; urgency=medium -- Samuel Henrique Wed, 11 Sep 2024 20:32:59 +0100 +curl (8.9.1-2ubuntu3) plucky; urgency=medium + + * SECURITY UPDATE: HSTS expiry overwrites parent cache entry. + - debian/patches/CVE-2024-9681.patch: Add bestsub, blen, and hostname + comparison in lib/hsts.c. + - CVE-2024-9681 + + -- Hlib Korzhynskyy Wed, 06 Nov 2024 09:10:08 -0330 + +curl (8.9.1-2ubuntu2) oracular; urgency=medium + + * SECURITY UPDATE: OCSP stapling bypass with GnuTLS + - debian/patches/CVE-2024-8096.patch: fix OCSP stapling management in + lib/vtls/gtls.c. + - CVE-2024-8096 + + -- Marc Deslauriers Mon, 16 Sep 2024 10:46:36 -0400 + +curl (8.9.1-2ubuntu1) oracular; urgency=medium + + * Merge with Debian unstable (LP: #2076679). Remaining changes: + - debian/control: Don't build-depend on python3-impacket and stunnel4 on + i386 so we can drop it (and its dependencies) from the i386 partial port. + It's only used for the tests, which do not block the build in any case. + - d/{control,rules}: Do not use gnutls for the curl binary. + - d/{control,rules}: Drop nghttp3 & ngtcp2 depdendencies of + libcurl-gnutls to avoid component-mismatch. + * Drop Changes: + - d/t/upstream-tests-{gnutls,openssl}: Add workaround to fix + LP: 2071468. The issue was fixed in dpkg-dev 1.22.11ubuntu1. + * New Changes: + - d/rules: Use libssh2-dev as it is in main (LP: #2076865). + + -- Vladimir Petko Tue, 13 Aug 2024 09:16:22 +1200 + curl (8.9.1-2) unstable; urgency=medium [ Steve McIntyre ] @@ -326,6 +482,36 @@ curl (8.8.0-4) unstable; urgency=medium -- Samuel Henrique Wed, 10 Jul 2024 22:36:04 +0100 +curl (8.8.0-3ubuntu4) oracular; urgency=medium + + * Rebuild against new dpkg without elf-package-metadata. + + -- Gianfranco Costamagna Wed, 07 Aug 2024 15:22:33 +0200 + +curl (8.8.0-3ubuntu3) oracular; urgency=medium + + * d/{control,rules}: Do not use gnutls for the curl binary + * d/{control,rules}: Drop nghttp3 & ngtcp2 depdendencies of libcurl-gnutls + to avoid component-mismatch + + -- Lukas Märdian Tue, 09 Jul 2024 14:30:56 +0200 + +curl (8.8.0-3ubuntu2) oracular; urgency=medium + + * d/t/upstream-tests-{gnutls,openssl}: Add workaround to fix + LP: #2071468. + + -- Sergio Durigan Junior Mon, 08 Jul 2024 16:25:16 -0400 + +curl (8.8.0-3ubuntu1) oracular; urgency=low + + * Merge from Debian unstable. Remaining changes: + - debian/control: Don't build-depend on python3-impacket and stunnel4 on + i386 so we can drop it (and its dependencies) from the i386 partial port. + It's only used for the tests, which do not block the build in any case. + + -- Gianfranco Costamagna Mon, 08 Jul 2024 15:45:32 +0200 + curl (8.8.0-3) unstable; urgency=medium [ Carlos Henrique Lima Melara ] @@ -340,6 +526,15 @@ curl (8.8.0-3) unstable; urgency=medium -- Samuel Henrique Sun, 07 Jul 2024 00:42:42 +0100 +curl (8.8.0-2ubuntu1) oracular; urgency=low + + * Merge from Debian unstable. Remaining changes: + - debian/control: Don't build-depend on python3-impacket and stunnel4 on + i386 so we can drop it (and its dependencies) from the i386 partial port. + It's only used for the tests, which do not block the build in any case. + + -- Gianfranco Costamagna Wed, 03 Jul 2024 11:43:21 +0200 + curl (8.8.0-2) unstable; urgency=medium * curl.NEWS: Announce switch to GnuTLS, HTTP3 support and wcurl @@ -352,6 +547,16 @@ curl (8.8.0-2) unstable; urgency=medium -- Samuel Henrique Sun, 30 Jun 2024 13:53:05 +0100 +curl (8.8.0-1ubuntu1) oracular; urgency=medium + + * Merge with Debian unstable. Remaining changes: + - debian/control: Don't build-depend on python3-impacket and stunnel4 on + i386 so we can drop it (and its dependencies) from the i386 partial port. + It's only used for the tests, which do not block the build in any case. + * Drop CVE-2024-0853 CVE-2024-2004 and CVE-2024-2398 fixes, now upstream + + -- Gianfranco Costamagna Fri, 24 May 2024 16:08:30 +0200 + curl (8.8.0-1) unstable; urgency=medium * New upstream version 8.8.0 @@ -478,6 +683,83 @@ curl (8.6.0-1) unstable; urgency=medium -- Samuel Henrique Wed, 31 Jan 2024 21:51:05 +0000 +curl (8.5.0-2ubuntu10.1) noble-security; urgency=medium + + * SECURITY UPDATE: Usage of disabled protocol + - debian/patches/CVE-2024-2004-pre1.patch: test1474: removed. + - debian/patches/CVE-2024-2004.patch: fix disabling all protocols in + lib/setopt.c, tests/data/Makefile.inc, tests/data/test1474. + - CVE-2024-2004 + * SECURITY UPDATE: HTTP/2 push headers memory-leak + - debian/patches/CVE-2024-2398.patch: push headers better cleanup in + lib/http2.c. + - CVE-2024-2398 + + -- Marc Deslauriers Mon, 22 Apr 2024 12:00:57 -0400 + +curl (8.5.0-2ubuntu10) noble; urgency=high + + * No change rebuild against libgnutls30t64, libnettle8t64, libpsl5t64, + libssl3t64. + + -- Julian Andres Klode Mon, 08 Apr 2024 16:38:07 +0200 + +curl (8.5.0-2ubuntu9) noble; urgency=medium + + * No-change rebuild for CVE-2024-3094 + + -- Steve Langasek Sun, 31 Mar 2024 00:50:18 +0000 + +curl (8.5.0-2ubuntu8) noble; urgency=medium + + * Drop build-dependency on stunnel4 for i386: we already don't run tests + on i386. + + -- Steve Langasek Sun, 24 Mar 2024 03:10:54 +0000 + +curl (8.5.0-2ubuntu7) noble; urgency=medium + + * Rename libraries for 64-bit time_t transition. Closes: #1061992, + #1065315. + + -- Steve Langasek Fri, 15 Mar 2024 10:19:32 -0700 + +curl (8.5.0-2ubuntu6) noble; urgency=medium + + * Build without forcing the nocheck profile. + + -- Dan Bungert Mon, 11 Mar 2024 14:51:34 -0600 + +curl (8.5.0-2ubuntu5) noble; urgency=medium + + * Build with nocheck profile. + + -- Matthias Klose Thu, 07 Mar 2024 10:56:24 +0100 + +curl (8.5.0-2ubuntu3) noble; urgency=medium + + * No-change rebuild against libssl3t64 + + -- Steve Langasek Mon, 04 Mar 2024 17:36:56 +0000 + +curl (8.5.0-2ubuntu2) noble; urgency=medium + + * SECURITY UPDATE: OCSP verification bypass with TLS session reuse + - debian/patches/CVE-2024-0853.patch: when verifystatus fails, remove + session id from cache in lib/vtls/openssl.c. + - CVE-2024-0853 + + -- Marc Deslauriers Wed, 31 Jan 2024 11:09:34 -0500 + +curl (8.5.0-2ubuntu1) noble; urgency=medium + + * Merge with Debian unstable (LP: #2045886). Remaining changes: + - debian/control: Don't build-depend on python3-impacket on i386 + so we can drop it (and its dependencies) from the i386 partial port. + It's only used for the tests, which do not block the build in any case. + + -- Danilo Egea Gondolfo Tue, 02 Jan 2024 09:32:27 +0000 + curl (8.5.0-2) unstable; urgency=medium * d/p/openldap_fix_an_LDAP_crash.patch: New patch to fix ldap segfault @@ -505,6 +787,22 @@ curl (8.5.0-1) unstable; urgency=medium -- Samuel Henrique Wed, 06 Dec 2023 20:15:49 +0000 +curl (8.4.0-2ubuntu1) noble; urgency=medium + + * Merge from Debian unstable (LP: #2039798). Remaining changes: + - debian/control: Don't build-depend on python3-impacket on i386 + so we can drop it (and its dependencies) from the i386 partial port. + It's only used for the tests, which do not block the build in any case. + * Drop patches for CVEs fixed upstream: + - debian/patches/CVE-2023-38039.patch + - debian/patches/CVE-2023-38545.patch + - debian/patches/CVE-2023-38546.patch + * Drop delta merged in Debian: + - debian/tests/control + - debian/tests/curl-ldapi-test + + -- Danilo Egea Gondolfo Wed, 01 Nov 2023 12:06:23 +0000 + curl (8.4.0-2) unstable; urgency=medium * d/rules: set CURL_PATCHSTAMP to package's version, so it shows up in @@ -564,6 +862,46 @@ curl (8.2.1-2) unstable; urgency=medium -- Samuel Henrique Fri, 25 Aug 2023 20:05:02 +0100 +curl (8.2.1-1ubuntu3.1) mantic-security; urgency=medium + + * SECURITY UPDATE: SOCKS5 heap buffer overflow + - debian/patches/CVE-2023-38545.patch: return error if hostname too + long for remote resolve in lib/socks.c, tests/data/Makefile.inc, + tests/data/test728. + - CVE-2023-38545 + * SECURITY UPDATE: cookie injection with none file + - debian/patches/CVE-2023-38546.patch: remove unnecessary struct fields + in lib/cookie.c, lib/cookie.h, lib/easy.c. + - CVE-2023-38546 + + -- Marc Deslauriers Tue, 03 Oct 2023 20:03:05 -0400 + +curl (8.2.1-1ubuntu3) mantic; urgency=medium + + * SECURITY UPDATE: HTTP headers eat all memory + - debian/patches/CVE-2023-38039.patch: return error when receiving too + large header set in lib/c-hyper.c, lib/cf-h1-proxy.c, lib/http.c, + lib/http.h, lib/pingpong.c, lib/urldata.h. + - CVE-2023-38039 + + -- Marc Deslauriers Mon, 11 Sep 2023 09:05:17 -0400 + +curl (8.2.1-1ubuntu2) mantic; urgency=medium + + * d/t/control, d/t/curl-ldapi-test: move test-command to an actual + test script and add a retry logic (LP: #2030911) + + -- Andreas Hasenack Wed, 09 Aug 2023 17:10:40 -0300 + +curl (8.2.1-1ubuntu1) mantic; urgency=low + + * Merge from Debian unstable. Remaining changes: + - Don't build-depend on python3-impacket on i386 so we can drop it + (and its dependencies) from the i386 partial port. It's only used for + the tests, which do not block the build in any case. + + -- Gianfranco Costamagna Sat, 05 Aug 2023 16:06:26 +0200 + curl (8.2.1-1) unstable; urgency=medium [ Samuel Henrique ] @@ -604,6 +942,15 @@ curl (7.88.1-11) unstable; urgency=mediu -- Samuel Henrique Fri, 28 Jul 2023 21:11:25 +0100 +curl (7.88.1-10ubuntu1) mantic; urgency=low + + * Merge from Debian unstable. Remaining changes: + - Don't build-depend on python3-impacket on i386 so we can drop it + (and its dependencies) from the i386 partial port. It's only used for + the tests, which do not block the build in any case. + + -- Gianfranco Costamagna Fri, 19 May 2023 08:46:54 +0200 + curl (7.88.1-10) unstable; urgency=medium * Add new patches to fix CVEs (closes: #1036239): @@ -616,6 +963,15 @@ curl (7.88.1-10) unstable; urgency=mediu -- Samuel Henrique Thu, 18 May 2023 23:43:40 +0100 +curl (7.88.1-9ubuntu1) mantic; urgency=low + + * Merge from Debian unstable. Remaining changes: + - Don't build-depend on python3-impacket on i386 so we can drop it + (and its dependencies) from the i386 partial port. It's only used for + the tests, which do not block the build in any case. + + -- Gianfranco Costamagna Tue, 02 May 2023 08:47:52 +0200 + curl (7.88.1-9) unstable; urgency=medium [ Sergio Durigan Junior ] @@ -630,6 +986,15 @@ curl (7.88.1-9) unstable; urgency=medium -- Samuel Henrique Sat, 15 Apr 2023 20:03:44 +0100 +curl (7.88.1-8ubuntu1) lunar; urgency=low + + * Merge from Debian unstable. Remaining changes: + - Don't build-depend on python3-impacket on i386 so we can drop it + (and its dependencies) from the i386 partial port. It's only used for + the tests, which do not block the build in any case. + + -- Gianfranco Costamagna Mon, 27 Mar 2023 07:50:29 +0200 + curl (7.88.1-8) unstable; urgency=medium [ Samuel Henrique ] @@ -643,6 +1008,15 @@ curl (7.88.1-8) unstable; urgency=medium -- Samuel Henrique Sun, 26 Mar 2023 11:36:24 +0100 +curl (7.88.1-7ubuntu1) lunar; urgency=low + + * Merge from Debian unstable. Remaining changes: + - Don't build-depend on python3-impacket on i386 so we can drop it + (and its dependencies) from the i386 partial port. It's only used for + the tests, which do not block the build in any case. + + -- Gianfranco Costamagna Wed, 22 Mar 2023 11:51:25 +0100 + curl (7.88.1-7) unstable; urgency=medium * Bump Standards-Version to 4.6.2 @@ -658,6 +1032,15 @@ curl (7.88.1-7) unstable; urgency=medium -- Samuel Henrique Tue, 21 Mar 2023 22:39:05 +0000 +curl (7.88.1-6ubuntu1) lunar; urgency=low + + * Merge from Debian unstable. Remaining changes: + - Don't build-depend on python3-impacket on i386 so we can drop it + (and its dependencies) from the i386 partial port. It's only used for + the tests, which do not block the build in any case. + + -- Gianfranco Costamagna Mon, 13 Mar 2023 10:10:19 +0100 + curl (7.88.1-6) unstable; urgency=medium * d/rules: Ignore test results from tests that fail on IPv6-only builders @@ -710,6 +1093,22 @@ curl (7.88.1-2) unstable; urgency=medium -- Samuel Henrique Fri, 03 Mar 2023 08:28:19 +0000 +curl (7.88.1-1ubuntu1) lunar; urgency=medium + + * Merge from Debian unstable (LP: #2008123). Remaining changes: + + Drop patches for CVEs fixed upsteam. + - debian/patches/CVE-2023-23914_5-1.patch + - debian/patches/CVE-2023-23914_5-2.patch + - debian/patches/CVE-2023-23914_5-3.patch + - debian/patches/CVE-2023-23914_5-4.patch + - debian/patches/CVE-2023-23914_5-5.patch + - debian/patches/CVE-2023-23916.patch + + Don't build-depend on python3-impacket on i386 so we can drop it + (and its dependencies) from the i386 partial port. It's only used for + the tests, which do not block the build in any case. + + -- Danilo Egea Gondolfo Wed, 22 Feb 2023 17:14:26 +0000 + curl (7.88.1-1) unstable; urgency=medium * New upstream version 7.88.1 @@ -724,6 +1123,41 @@ curl (7.88.1-1) unstable; urgency=medium -- Samuel Henrique Mon, 20 Feb 2023 22:35:53 +0000 +curl (7.87.0-2ubuntu2) lunar; urgency=medium + + * SECURITY UPDATE: multiple HSTS issues + - debian/patches/CVE-2023-23914_5-1.patch: add sharing of HSTS cache + among handles in docs/libcurl/opts/CURLSHOPT_SHARE.3, + docs/libcurl/symbols-in-versions, include/curl/curl.h, lib/hsts.c, + lib/hsts.h, lib/setopt.c, lib/share.c, lib/share.h, lib/transfer.c, + lib/url.c, lib/urldata.h. + - debian/patches/CVE-2023-23914_5-2.patch: share HSTS between handles + in src/tool_operate.c. + - debian/patches/CVE-2023-23914_5-3.patch: handle adding the same host + name again in lib/hsts.c. + - debian/patches/CVE-2023-23914_5-4.patch: support crlf="yes" for + verify/proxy in tests/FILEFORMAT.md, tests/runtests.pl. + - debian/patches/CVE-2023-23914_5-5.patch: verify hsts with two URLs in + tests/data/Makefile.inc, tests/data/test446. + - CVE-2023-23914 + - CVE-2023-23915 + * SECURITY UPDATE: HTTP multi-header compression denial of service + - debian/patches/CVE-2023-23916.patch: do not reset stage counter for + each header in lib/content_encoding.c, lib/urldata.h, + tests/data/Makefile.inc, tests/data/test387, tests/data/test418. + - CVE-2023-23916 + + -- Marc Deslauriers Fri, 17 Feb 2023 08:19:10 -0500 + +curl (7.87.0-2ubuntu1) lunar; urgency=low + + * Merge from Debian unstable. Remaining changes: + - Don't build-depend on python3-impacket on i386 so we can drop it + (and its dependencies) from the i386 partial port. It's only used for + the tests, which do not block the build in any case. + + -- Gianfranco Costamagna Wed, 01 Feb 2023 11:24:47 +0100 + curl (7.87.0-2) unstable; urgency=medium * d/patches: Add new upstream patch to fix regression in setopt/getinfo @@ -732,6 +1166,14 @@ curl (7.87.0-2) unstable; urgency=medium -- Samuel Henrique Sun, 15 Jan 2023 21:12:09 +0000 +curl (7.87.0-1ubuntu1) lunar; urgency=medium + + * Don't build-depend on python3-impacket on i386 so we can drop it + (and its dependencies) from the i386 partial port. It's only used for + the tests, which do not block the build in any case. + + -- Steve Langasek Sun, 08 Jan 2023 00:40:54 +0000 + curl (7.87.0-1) unstable; urgency=medium * New upstream version 7.87.0 @@ -3381,3 +3823,4 @@ curl (5.8-1) unstable; urgency=low * Initial Release. -- Leon Breedt Sun, 9 May 1999 18:55:48 +0200 + diff -pruN 8.14.1-1/debian/control 8.14.1-1ubuntu3/debian/control --- 8.14.1-1/debian/control 2025-06-04 07:21:05.000000000 +0000 +++ 8.14.1-1ubuntu3/debian/control 2025-06-13 18:06:46.000000000 +0000 @@ -1,7 +1,8 @@ Source: curl Section: web Priority: optional -Maintainer: Debian Curl Maintainers +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Debian Curl Maintainers Uploaders: Carlos Henrique Lima Melara , Samuel Henrique , Sergio Durigan Junior @@ -24,15 +25,12 @@ Build-Depends: dpkg-dev (>= 1.22.5), libtool, libzstd-dev, locales-all , - libngtcp2-dev (>= 1.2.0), - libngtcp2-crypto-gnutls-dev (>= 1.2.0), - libnghttp3-dev (>= 1.1.0), openssh-server , python3:native , - python3-impacket [!alpha !hppa !m68k !sh4] , + python3-impacket [!i386 !alpha !hppa !m68k !sh4] , gnutls-bin [!ppc64el] , quilt, - stunnel4 , + stunnel4 [!i386] , zlib1g-dev, Build-Conflicts: autoconf2.13, automake1.4 Standards-Version: 4.7.2 @@ -127,7 +125,6 @@ Depends: ${misc:Depends}, libkrb5-dev, libldap-dev, libnghttp2-dev, - libnghttp3-dev (>= 1.1.0), libpsl-dev, librtmp-dev, libssh2-1-dev, @@ -174,9 +171,6 @@ Depends: ${misc:Depends}, libkrb5-dev, libldap-dev, libnghttp2-dev, - libnghttp3-dev (>= 1.1.0), - libngtcp2-crypto-gnutls-dev (>= 1.2.0), - libngtcp2-dev (>= 1.2.0), libpsl-dev, librtmp-dev, libssh2-1-dev, diff -pruN 8.14.1-1/debian/rules 8.14.1-1ubuntu3/debian/rules --- 8.14.1-1/debian/rules 2025-06-04 07:21:05.000000000 +0000 +++ 8.14.1-1ubuntu3/debian/rules 2025-06-16 19:40:58.000000000 +0000 @@ -65,8 +65,8 @@ ifeq ($(filter pkg.curl.no-gnutls,$(DEB_ autoreconf -fi && \ cp ../../ltmain.sh . && \ dh_auto_configure ${CONFIGURE_ARGS} --with-gnutls \ - --with-ngtcp2 \ - --with-nghttp3 + --without-ngtcp2 \ + --without-nghttp3 endif override_dh_auto_build: