openssl1.0 (1.0.2n-1ubuntu5) bionic; urgency=medium

  * SECURITY UPDATE: DoS via ASN.1 types with a recursive definition
    - debian/patches/CVE-2018-0739.patch: limit stack depth in
      crypto/asn1/asn1.h, crypto/asn1/asn1_err.c, crypto/asn1/tasn_dec.c.
    - CVE-2018-0739

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 27 Mar 2018 13:48:57 -0400

openssl1.0 (1.0.2n-1ubuntu4) bionic; urgency=medium

  * s390x: Add support for CPACF enhancements to openssl, for IBM z14. LP:
    #1743750

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 28 Feb 2018 14:52:10 +0000

openssl1.0 (1.0.2n-1ubuntu3) bionic; urgency=medium

  * Create openssl1.0 package which ships 1.0 variant of utilities. LP: #1747447
  * Move libraries back from /lib to /usr/lib, as otherwise d-i helpfully
    deletes "duplicate" soname libraries, and thus breaking
    network-console. LP: #1749442

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 14 Feb 2018 15:40:29 +0000

openssl1.0 (1.0.2n-1ubuntu2) bionic; urgency=medium

  * Change package name to openssl1.0
  * Drop openssl, libssl-dev, libssl-doc packages, and stop adding
    symlinks for them.
  * Mark libssl1.0-dev to conflict with libssl-dev.
  * Correct soname in debian/libssl1.0.0-udeb.lintian-overrides and
    debian/libssl1.0.0.lintian-overrides.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 05 Feb 2018 11:35:03 +0000

openssl (1.0.2n-1ubuntu1) bionic; urgency=medium

  * Merge with Debian, remaining changes.
    - Use openssl source package name, instead of openssl1.0.
    - Make libssl-dev a metapackage pointing at libssl1.0-dev package.
    - Ship openssl package.
    - Disable SSLv3 without changing ABI:
      + debian/patches/no-sslv3.patch: Disable SSLv3 without using the
        no-ssl3-method option
      + debian/rules: don't use no-ssl3-method, don't bump soname
      + debian/patches/engines-path.patch: don't bump soname
      + debian/patches/version-script.patch: don't bump soname
      + debian/patches/soname.patch: removed
      + debian/lib*: don't bump soname
    - debian/rules: don't enable rfc3779 and cms support for now as it
      changes ABI.
    - debian/libssl1.0.0.postinst:
      + Display a system restart required notification on libssl1.0.0
        upgrade on servers.
      + Use a different priority for libssl1.0.0/restart-services depending
        on whether a desktop, or server dist-upgrade is being performed.
    - debian/{libcrypto1.0.0-udeb.dirs, libssl1.0.0.dirs, libssl1.0.0.files,
      rules}: Move runtime libraries to /lib, for the benefit of
      wpasupplicant.
    - debian/patches/perlpath-quilt.patch: Don't change perl #! paths under
      .pc.
    - debian/rules:
      + Don't run 'make test' when cross-building.
      + Use host compiler when cross-building.  Patch from Neil Williams.
      + Fix Makefile to properly clean up libs/ dirs in clean target.
      + Replace duplicate files in the doc directory with symlinks.
    - debian/control: Mark Debian Vcs-* as XS-Debian-Vcs-*
    - Enable asm optimisations on s390x. LP: #1602655.

  * Changes applied in Debian:
    - debian/rules: Enable optimized 64bit elliptic curve code contributed
      by Google.
    - debian/{libssl1.0.0-udeb.dirs, control, rules}: Create
      libssl1.0.0-udeb, for the benefit of wget-udeb. Same has been applied
      in Debian.

   * Dropped patches, part of new upstream release:
      - CVE-2016-2105.patch
      - CVE-2016-2106.patch
      - CVE-2016-2107.patch
      - CVE-2016-2108.patch
      - CVE-2016-2109.patch
      - 0b48a24ce993d1a4409d7bde26295f6df0d173cb.patch
      - CVE-2016-2177.patch
      - CVE-2016-2178-1.patch
      - CVE-2016-2178-2.patch
      - CVE-2016-2179.patch
      - CVE-2016-2180.patch
      - CVE-2016-2181-1.patch
      - CVE-2016-2181-2.patch
      - CVE-2016-2181-3.patch
      - CVE-2016-2182.patch
      - CVE-2016-2183.patch
      - CVE-2016-6302.patch
      - CVE-2016-6303.patch
      - CVE-2016-6304.patch
      - CVE-2016-6306-1.patch
      - CVE-2016-6306-2.patch
      - CVE-2016-2182-2.patch
      - CVE-2016-7055.patch
      - CVE-2016-8610.patch
      - CVE-2016-8610-2.patch
      - CVE-2017-3731.patch
      - CVE-2017-3732.patch
      - move-extended-feature-detection.patch
      - fix-sha-ni.patch
      - CVE-2017-3735.patch
      - CVE-2017-3736.patch
      - fix_armhf_ftbfs.patch
      - CVE-2017-3737-pre.patch
      - CVE-2017-3737-1.patch
      - CVE-2017-3737-2.patch
      - CVE-2017-3738.patch

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 15 Jan 2018 13:10:21 +0000

openssl1.0 (1.0.2n-1) unstable; urgency=medium

  * New upstream version 1.0.2n
    - drop patches which applied upstream:
      - 0001-Fix-no-ssl3-build.patch
      - 0001-aes-armv4-bsaes-armv7-sha256-armv4-.pl-make-it-work-.patch
    - Fixes CVE-2017-3737 (Read/write after SSL object in error state)
    - Fixes CVE-2017-3738 (rsaz_1024_mul_avx2 overflow bug on x86_64)
  * move to gbp
  * Abort the build if symbols are discovered which are not part of the
    symbols file.

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Wed, 13 Dec 2017 23:47:09 +0100

openssl1.0 (1.0.2m-3) unstable; urgency=medium

  * Avoid problems with aes and sha256 assembler on armhf using binutils 2.29

 -- Kurt Roeckx <kurt@roeckx.be>  Sun, 05 Nov 2017 17:28:52 +0100

openssl1.0 (1.0.2m-2) unstable; urgency=medium

  * Fix no-ssl3-method build

 -- Kurt Roeckx <kurt@roeckx.be>  Thu, 02 Nov 2017 19:00:50 +0100

openssl1.0 (1.0.2m-1) unstable; urgency=high

  [ Kurt Roeckx ]
  * New upstream version
    - Fixes CVE-2017-3735
    - Fixes CVE-2017-3736

  [ Sebastian Andrzej Siewior]
  * Add support for arm64ilp32, Patch by Wookey (Closes: #874709).

 -- Kurt Roeckx <kurt@roeckx.be>  Thu, 02 Nov 2017 14:30:51 +0100

openssl1.0 (1.0.2l-2) unstable; urgency=medium

  * Make the udeb use a versioned depends (Closes: #864081)

 -- Kurt Roeckx <kurt@roeckx.be>  Sun, 04 Jun 2017 19:15:33 +0200

# For older changelog entries, run 'apt-get changelog libssl1.0.0'
