strongswan (5.9.8-5+deb12u3) bookworm-security; urgency=medium

  * d/patch: fix integer overflow in EAP-TTLS plugin (CVE-2026-25075)

 -- Yves-Alexis Perez <corsac@debian.org>  Wed, 18 Mar 2026 08:53:16 +0100

strongswan (5.9.8-5+deb12u2) bookworm-security; urgency=medium

  * d/patches: add fix for buffer overflow in EAP-MSCHAPv2 (CVE-2025-62291)

 -- Yves-Alexis Perez <corsac@debian.org>  Wed, 15 Oct 2025 12:21:12 +0200

strongswan (5.9.8-5+deb12u1) bookworm-security; urgency=medium

  * d/patches: add fix for CVE-2023-41913 in charon-tkm
    Buffer Overflow When Handling DH Public Values

 -- Yves-Alexis Perez <corsac@debian.org>  Mon, 13 Nov 2023 21:29:34 +0100

strongswan (5.9.8-5) unstable; urgency=medium

  * No-change upload for source-only upload.

 -- Yves-Alexis Perez <corsac@debian.org>  Fri, 03 Mar 2023 18:56:58 +0100

strongswan (5.9.8-4) unstable; urgency=medium

  * d/patches: libtls-Fix-authentication-bypass-and-expired-pointer added.
    Fix authentication bypass and use-after-free in libtls (CVE-2023-26463)
  * d/control: replace lsb-base dependency by sysvinit-utils
  * d/control: update standards version to 4.6.2

 -- Yves-Alexis Perez <corsac@debian.org>  Sun, 26 Feb 2023 09:40:09 +0100

strongswan (5.9.8-3) unstable; urgency=medium

  * d/tests: also drop _copyright test since the util is gone as well

 -- Yves-Alexis Perez <corsac@debian.org>  Thu, 03 Nov 2022 18:17:42 +0100

strongswan (5.9.8-2) unstable; urgency=medium

  * d/tests: remove scepclient tests since it's gone (Closes: #1023224)

 -- Yves-Alexis Perez <corsac@debian.org>  Thu, 03 Nov 2022 13:05:27 +0100

strongswan (5.9.8-1) unstable; urgency=medium

  * New upstream version 5.9.8
    - Includes fix for  CVE-2022-40617, denial of service due to the
    revocation plugin potentially using untrusted OCSP URIs and CRL
    distribution points in CRLs. (closes: #1021271)
  * Remove strongswan-scepclient package, replaced by a pki(1) command
  * d/p/0006-fix-format-string-issue-in-enum_flags_to_string dropped, included
    upstream
  * remove dropped _copyright utility
  * d/strongswan-pki.install: install est/estca manpages (RFC 7070)
  * d/s-{started,swanctl}.lintian-overrides updated for new lintian
  * d/copyright updated for new upstream release

 -- Yves-Alexis Perez <corsac@debian.org>  Wed, 05 Oct 2022 15:25:18 +0200

strongswan (5.9.6-1) unstable; urgency=medium

  * New upstream version 5.9.6
  * d/p/0006-fix-format-string-issue-in-enum_flags_to_string added
  * d/libstrongswan.install: install kdf plugin in libstrongswan

 -- Yves-Alexis Perez <corsac@debian.org>  Sat, 07 May 2022 20:19:18 +0200

strongswan (5.9.5-2) unstable; urgency=medium

  * actually fix lintian overrides

 -- Yves-Alexis Perez <corsac@debian.org>  Wed, 26 Jan 2022 16:29:17 +0100

strongswan (5.9.5-1) unstable; urgency=medium

  * New upstream version 5.9.5
    - eap-authenticator: Enforce failure if MSK generation fails
      Fix incorrect handling of Early EAP-Success Messages (CVE-2021-45079)
  * update lintian overrides to match RUNPATH

 -- Yves-Alexis Perez <corsac@debian.org>  Wed, 26 Jan 2022 14:38:54 +0100

strongswan (5.9.4-1) unstable; urgency=medium

  [ Paride Legovini ]
  * tpm plugin: compile against the tpm2 software stack (tss2)
    (Closes: #994396, Ubuntu#1940079)

  [ Yves-Alexis Perez ]
  * New upstream version 5.9.4
  * d/patches rebased against new upstream
  * Enable forecast plugin (Closes: #943457)
  * update lintian overrides for new lintian
  * d/control: update standards version to 4.6.0
  * d/s-starter.postrm: use which to check for command existence

 -- Yves-Alexis Perez <corsac@debian.org>  Tue, 19 Oct 2021 22:34:40 +0200

strongswan (5.9.1-1) unstable; urgency=medium

  * New upstream version 5.9.1
  * d/patches: rebase against new upstream version
  * d/watch: update to version 4

 -- Yves-Alexis Perez <corsac@debian.org>  Wed, 11 Nov 2020 17:54:34 +0100

strongswan (5.9.0-1) unstable; urgency=medium

  * New upstream version 5.9.0

 -- Yves-Alexis Perez <corsac@debian.org>  Thu, 17 Sep 2020 10:21:30 +0200

strongswan (5.8.4-1) unstable; urgency=medium

  * New upstream version 5.8.4 (Closes: #956446)
  * d/rules: drop --as-needed from linker flags
  * d/control: update standards version to 4.5.0

 -- Yves-Alexis Perez <corsac@debian.org>  Thu, 30 Apr 2020 08:57:26 +0200

strongswan (5.8.2-2) unstable; urgency=medium

  * d/control: replace libip{4,6}tc-dev by libiptc-dev (Closes: #951016)
  * d/copyright updated

 -- Yves-Alexis Perez <corsac@debian.org>  Thu, 13 Feb 2020 22:46:40 +0100

strongswan (5.8.2-1) unstable; urgency=medium

  [ Jean-Michel Vourgère ]
  * README.Debian: Fixed typo

  [ Yves-Alexis Perez ]
  * d/control: replace iptables-dev b-dep by libip{4,6}tc-dev (Closes: #946148)
  * d/watch: use uscan special strings
  * New upstream version 5.8.2
  * d/control: update dh compat level to 12
  * strongswan-nm: update path for dbus service file
  * install DRBG plugin to libstrongswan
  * d/control: add ${misc:Pre-Depends} to strongswan-starter

 -- Yves-Alexis Perez <corsac@debian.org>  Wed, 01 Jan 2020 14:35:46 +0100

strongswan (5.8.1-1) unstable; urgency=medium

  * d/rules: disable http and stream tests under CI
  * New upstream version 5.8.1

 -- Yves-Alexis Perez <corsac@debian.org>  Fri, 18 Oct 2019 16:44:27 +0200

strongswan (5.8.0-2) unstable; urgency=medium

  [ Christian Ehrhardt ]
  * d/control: Mention mgf1 plugin which is in libstrongswan now
  * Complete the disabling of libfast
  * Clean up d/strongswan-starter.postinst: section about runlevel changes
  * Clean up d/strongswan-starter.postinst: opportunistic encryption
  * Enable kernel-libipsec for use of strongswan in containers
  * d/control, d/libcharon-{extras,extauth}-plugins.install: Add
    extauth-plugins package (Recommends)
  * apparmor: d/usr.lib.ipsec.charon: sync notify rule from charon-systemd
  * apparmor: fix apparmor denies reading the own FDs (LP: 1786250)
  * apparmor: d/usr.sbin.charon-systemd: allow CLUSTERIP for ha plugin
    (LP: 1773956)
  * apparmor: d/usr.lib.ipsec.stroke: executables need to be able to read map
    and execute themselves
  * apparmor: d/usr.lib.ipsec.lookip: executables need to be able to read map
    and execute themselves
  * apparmor: d/usr.sbin.swanctl: add apparmor rule for af-alg plugin
    (LP: 1807962)
  * d/control: libtpmtss is actually packaged in libstrongswan-extra-plugins

  [ Ryan Harper ]
  * Remove code related to unused debconf managed config

  [ Yves-Alexis Perez ]
  * ship xfrmi only on Linux, fix FTBFS on kfreebsd
  * d/libcharon-extra-plugins.install: drop plugins disabled in Debian
  * d/control: update standards version to 4.4.1
  * d/strongswan-starter.templates: drop runlevel_changes
  * let dh_installinit handle update-rc.d calls
  * d/salsa-ci.yml: add a salsa pipeline config
  * d/rules: drop dbgsym migration
  * strongswan-starter: update line number in lintian override

 -- Yves-Alexis Perez <corsac@debian.org>  Sat, 05 Oct 2019 15:03:59 +0200

strongswan (5.8.0-1) unstable; urgency=medium

  [ Christian Ehrhardt ]
  * Fix fails in debian CI (Closes: #926479)

  [ Simon Deziel ]
  * d/usr.lib.ipsec.charon, d/usr.sbin.charon-systemd: add CAP_SETPCAP to
    apparmor to allow dropping caps
  * d/usr.sbin.swanctl: add attach_disconnected to work inside containers
  * d/usr.sbin.charon-systemd: allow accessing the binary
  * d/usr.sbin.swanctl: allow reading own binary

  [ Yves-Alexis Perez ]
  * New upstream version 5.8.0
  * d/control: update standards version to 4.4.0
  * use debhelper-compat b-d for dh compat level
  * d/control: bump dh compat level to 11
  * d/rules: drop systemd addon, useless in compat 11
  * strongswan-libcharon: install xfrmi binary
  * d/patches refreshed for new upstream release
  * handle renaming of systemd service files
  * d/control: remove obsolete breaks/replaces

 -- Yves-Alexis Perez <corsac@debian.org>  Mon, 26 Aug 2019 12:58:23 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog strongswan-libcharon`.
