netatalk (3.1.12~ds-4ubuntu0.20.04.4) focal-security; urgency=medium

  * SECURITY UPDATE: memory leak vulnerability
    - d/p/CVE-2024-38439-38440-38441.patch: harden user login by doing null
      pointer and length checks on input buffer
    - CVE-2024-38439
    - CVE-2024-38440
    - CVE-2024-38441
  * SECURITY UPDATE: arbitrary file writing vulnerability
    - d/p/CVE-2022-22995.patch: Harden create_appledesktop_folder()
    - CVE-2022-22995

 -- Shishir Subedi <shishir.subedi@canonical.com>  Tue, 11 Mar 2025 10:15:25 +0545

netatalk (3.1.12~ds-4ubuntu0.20.04.3) focal-security; urgency=medium

  * SECURITY UPDATE: remote code execution
    - debian/patches/CVE-2023-42464.patch: validate data type in
      dalloc_value_for_key() to avoid type confusion.
    - CVE-2023-42464

 -- Allen Huang <allen.huang@canonical.com>  Thu, 07 Dec 2023 13:48:08 +0000

netatalk (3.1.12~ds-4ubuntu0.20.04.1) focal-security; urgency=medium

  * SECURITY UPDATE: RCE vulnerability
    - debian/patches/CVE-2021-31439.patch: libatalk: apply limit checking
      to DSI write offset
    - CVE-2021-31439
  * SECURITY UPDATE: RCE with root privileges
    - debian/patches/CVE-2022-0194_23122_23123_23124_*.patch: add defines
      for icon lengths, harden ad_entry(), add handling for cases where
      ad_entry() returns NULL, protect against removing AFP metadata xattr,
      avoid setting adouble entries on symlinks
    - debian/patches/CVE-2022-23121-*.patch: apply hardening to
      parse_entries()
    - debian/patches/CVE-2022-23125.patch: harden copyapplfile()
    - debian/patches/CVE-2022-43634.patch: fix dsi_writeinit() function
    - CVE-2022-0194
    - CVE-2022-23121
    - CVE-2022-23122
    - CVE-2022-23123
    - CVE-2022-23124
    - CVE-2022-23125
    - CVE-2022-43634
  * SECURITY UPDATE: heap-based buffer overflow
    - debian/patches/CVE-2022-45188.patch: fixes the heap-based buffer
      overflow in afp_getappl()
    - CVE-2022-45188

 -- Nishit Majithia <nishit.majithia@canonical.com>  Thu, 08 Jun 2023 09:48:49 +0530

netatalk (3.1.12~ds-4) unstable; urgency=medium

  * Fix Vcs-Git URL.
  * Extend patch 101 to support cross-building.
    Closes: Bug#942185. Thanks to Helmut Grohne.
  * Declare compliance with Debian Policy 4.2.1.
  * Set Rules-Requires-Root: no.

 -- Jonas Smedegaard <dr@jones.dk>  Fri, 11 Oct 2019 19:11:33 +0200

netatalk (3.1.12~ds-3) unstable; urgency=medium

  * Update autopkgtest: Add sbin paths to PATH.

 -- Jonas Smedegaard <dr@jones.dk>  Sat, 02 Mar 2019 00:32:52 +0100

netatalk (3.1.12~ds-2) unstable; urgency=medium

  * Fix stop build-depend on obsolete libmysqlclient-dev.
    Adapt smoketest.
    Update documentation to include CNID backend mysql
    to list of GPL-incompatible features
    legally possible only in local rebuild.
  * Bump documentation timestamps,
    and timestamp each topic separately.

 -- Jonas Smedegaard <dr@jones.dk>  Sat, 23 Feb 2019 11:04:52 +0100

netatalk (3.1.12~ds-1) unstable; urgency=medium

  [ upstream ]
  * New release(s).
    Closes: Bug#685878.
    + AppleTalk networking protocol support dropped.
      Closes: Bug#187512, #467513, #467514, #489800, #599402, #652825, #660768.
    + Printer Access Protocol (PAP) support dropped.
      Closes: Bug#66875, #86185, #141405, #316563, #336495, #772280, #716165.

  [ Igor Bernstein ]
  * Drop patches and configure options obsoleted by upstream changes.
  * Stop install documentation no longer provided upstream.
  * Install shared library and files in /var/lib, actually used now.

  [ Michele Porelli ]
  * Change init style to systemd.

  [ Adrian Knoth ]
  * Drop rules for uniconv.
  * Build-depend on dh-systemd.

  [ Jonas Smedegaard ]
  * Re-add sysV init script, alongside systemd.
  * Repackage upstream source:
    + Exclude embedded code copies of libtalloc libtdb.
    + Exclude pre-generated spotlight code.
  * Update patches:
    + Drop patches applied upstream.
    + Extend patch 103 with fixes for additional typos.
    + Add patch 204 to use FHS-compatible state dir /var/lib/netatalk.
    + Unfuzz patches.
  * Update watch file:
    + Rewrite usage comment.
    + Use substitution strings.
    + Use suffix ~ds for repackaged upstream source.
  * Update copyright info:
    + Fix track scripts by HAT, licensed GPL-2+.
    + Update coverage, track exclusions, and stop track gone files.
    + Track new source files licensed GPL-2/GPL-2+/Autoconf-or-GPL-3+.
  * Build linked with system shared libtalloc libtdb.
    Add patches 101 201 to use system shared libraries libtalloc libtdb.
    Build-depend on libtalloc-dev libtdb-dev.
  * Enable AFPStats D-Bus service.
    Add patch 102 to migrate to and use python3.
    Build-depend on libdbus-glib-1-dev.
    Recommend dbus python3 python3-dbus.
  * Enable integration with SystemTap.
    Build-depend on systemtap-sdt-dev.
  * Add NEWS entry listing disruptive changes.
  * Stop create obsolete directory var/spool/netatalk.
  * Stop provide unmaintained logcheck snippets.
  * Enable autopkgtest.
  * Improve build-time check for OpenSSL license violation.
  * Avoid install manpages for obsolete or avoided commands.
  * Update documentation:
    + Drop duplicated changelog and copyright info in README.Debian.
    + Drop obsolete README.Debian note about manual BerkeleyDB migration,
      and about AppleTalk DDP and host-to-ip resolving.
  * Stop build GSS UAM (except in custom build):
    Causes license violation linking against OpenSSL.
    Stop build-depend on libkrb5-dev.
    Update documentation to mention GSS UAM in OpenSSL notes.
  * Build new mysql UAM, linking against libmysqlclient
    (not libmariadb to avoid license violation).
    Build-depend on libmysqlclient-dev.
  * Fix stop enable cracklib support,
    needed only with randnum UAM which requires OpenSSL.
    Update documentation.
    Stop build-depend on libcrack2-dev.
    Stop recommend libpam-cracklib, avahi-daemon.
  * Update short and long descriptions
    to talk only about Apple Filing Protocol
    (not obsolete AppleTalk protocol),
    and elaborate on differences with SMB protocol.
  * Stop build-depend on libcups2-dev, recommend rc db-util,
    or suggest texlive-base-bin quota:
    Needed for no longer provided features.
  * Enable Spotlight integration with tracker.
    Build-depend on bison flex: Needed to generate Spotlight code.
    Build-depend on libtracker-miner-2.0-dev libtracker-sparql-2.0-dev.
    Build-depend on and recommend tracker.
  * Add patch 104 to modernize Systemd service file.

 -- Jonas Smedegaard <dr@jones.dk>  Mon, 18 Feb 2019 12:54:10 +0100

netatalk (2.2.6-3) unstable; urgency=high

  * Regenerate autotools during build.
    Really closes: Bug#912091. Thanks (again!) to Helmut Grohne.
  * Set urgency=high due to previously fixed CVE-2018-1160.

 -- Jonas Smedegaard <dr@jones.dk>  Sun, 23 Dec 2018 11:48:52 +0100

netatalk (2.2.6-2) unstable; urgency=medium

  * Acknowledge NMUs.
    Closes: Bug#864125, #916930.
    Thanks to Salvatore Bonaccorso and Andreas Metzler.
  * Simplify rules:
    + Stop resolve build-dependencies in rules file.
  * Update notes on local build linked with OpenSSL:
    + Rephrase centered on usage needs (not legalese).
    + Use apt (not aptitude or apt-get) in interactive commands.
    + Stop reference obsolete unofficial package repository.
    + Move build details to README.source.
  * Update Vcs-* fields: Maintenance moved to Salsa.
  * Stop build-depend on dh-buildinfo.
  * Update copyright info:
    + Extend coverage of packaging.
    + Use https protocol in format URL.
  * Wrap and sort control file, and strip trailing spaces.
  * Use package priority optional (not extra).
  * Declare compliance with Debian Policy 4.2.1.
  * Fix depend on lsb-base.
  * Configure with --enable-a2boot.
    Closes: Bug#907958. Thanks to T. Joseph Carter.
  * Add patch 106
    to fix detect Berkeley DB installed in multiarch location.
    Closes: Bug#912091. Thanks to Helmut Grohne.
  * Add patches cherry-picked upstream
    to fix unauthenticated remote code execution
    (replacing semantically identical patch 115 added in 2.2.6-1.2).

 -- Jonas Smedegaard <dr@jones.dk>  Sat, 22 Dec 2018 19:04:35 +0100

netatalk (2.2.6-1.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Unauthenticated remote code execution in Netatalk (CVE-2018-1160)
    (Closes: #916930)

 -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 20 Dec 2018 21:05:54 +0100

# For older changelog entries, run 'apt-get changelog netatalk'
