openssl (1.1.0g-2ubuntu4) bionic; urgency=medium

  * debian/patches/rehash-pass-on-dupes.patch: Don't return 1 when a duplicate
    certificate is found. (LP: #1764848)

 -- Brian Murray <brian@ubuntu.com>  Wed, 25 Apr 2018 10:03:48 -0700

openssl (1.1.0g-2ubuntu3) bionic; urgency=medium

  * SECURITY UPDATE: overflow bug in AVX2 Montgomery multiplication
    - debian/patches/CVE-2017-3738.patch: fix digit correction bug in
      crypto/bn/asm/rsaz-avx2.pl.
    - CVE-2017-3738
  * SECURITY UPDATE: DoS via ASN.1 types with a recursive definition
    - debian/patches/CVE-2018-0739.patch: limit stack depth in
      crypto/asn1/asn1_err.c, crypto/asn1/tasn_dec.c,
      include/openssl/asn1.h.
    - CVE-2018-0739

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 27 Mar 2018 13:45:15 -0400

openssl (1.1.0g-2ubuntu2) bionic; urgency=medium

  * s390x: Add support for CPACF enhancements to openssl, for IBM z14. LP:
    #1743750

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Tue, 27 Feb 2018 13:01:19 +0000

openssl (1.1.0g-2ubuntu1) bionic; urgency=medium

  * Merge from Debian unstable, remaining changes:
    - Replace duplicate files in the doc directory with symlinks.
    - debian/libssl1.1.postinst:
      + Display a system restart required notification on libssl1.1
        upgrade on servers.
      + Use a different priority for libssl1.1/restart-services depending
        on whether a desktop, or server dist-upgrade is being performed.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Mon, 05 Feb 2018 13:16:42 +0000

openssl (1.1.0g-2) unstable; urgency=high

  * Avoid problems with aes assembler on armhf using binutils 2.29

 -- Kurt Roeckx <kurt@roeckx.be>  Sat, 04 Nov 2017 12:48:13 +0100

openssl (1.1.0g-1) unstable; urgency=medium

  * New upstream version
    - Fixes CVE-2017-3735
    - Fixes CVE-2017-3736
  * Remove patches applied upstream
  * Temporary enable TLS 1.0 and 1.1 again (#875423)
  * Attempt to fix testsuite race condition
  * update no-symbolic.patch to apply

 -- Kurt Roeckx <kurt@roeckx.be>  Thu, 02 Nov 2017 15:22:48 +0100

openssl (1.1.0f-5) unstable; urgency=medium

  * Instead of completly disabling TLS 1.0 and 1.1, just set the minimum
    version to TLS 1.2 by default. TLS 1.0 and 1.1 can be enabled again by
    calling SSL_CTX_set_min_proto_version() or SSL_set_min_proto_version().

 -- Kurt Roeckx <kurt@roeckx.be>  Tue, 08 Aug 2017 16:13:54 +0200

openssl (1.1.0f-4) unstable; urgency=medium

  [ Sebastian Andrzej Siewior ]
  * Add support for arm64ilp32, patch by Wookey (Closes: #867240)

  [ Kurt Roeckx ]
  * Disable TLS 1.0 and 1.1, leaving 1.2 as the only supported SSL/TLS
    version. This will likely break things, but the hope is that by
    the release of Buster everything will speak at least TLS 1.2. This will be
    reconsidered before the Buster release.
  * Fix a race condition in the test suite (Closes: #869856)

 -- Kurt Roeckx <kurt@roeckx.be>  Mon, 07 Aug 2017 01:08:45 +0200

openssl (1.1.0f-3) unstable; urgency=medium

  * Don't cleanup a thread-local key we didn't create it (Closes: #863707)

 -- Kurt Roeckx <kurt@roeckx.be>  Mon, 05 Jun 2017 11:40:42 +0200

openssl (1.1.0f-2) unstable; urgency=medium

  * Make the udeb use a versioned depends (Closes: #864080)
  * Conflict with libssl1.0-dev (Closes: #863367)

 -- Kurt Roeckx <kurt@roeckx.be>  Sun, 04 Jun 2017 12:07:38 +0200

# For older changelog entries, run 'apt-get changelog libssl-doc'
