openssl (1.1.1f-1ubuntu2) focal; urgency=medium

  * SECURITY UPDATE: Segmentation fault in SSL_check_chain
    - debian/patches/CVE-2020-1967-1.patch: add test for CVE-2020-1967 in
      test/recipes/70-test_sslsigalgs.t.
    - debian/patches/CVE-2020-1967-2.patch: fix NULL dereference in
      SSL_check_chain() for TLS 1.3 in ssl/t1_lib.c.
    - debian/patches/CVE-2020-1967-3.patch: fix test in
      test/recipes/70-test_sslsigalgs.t.
    - debian/patches/CVE-2020-1967-4.patch: fix test in
      test/recipes/70-test_sslsigalgs.t.
    - CVE-2020-1967

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 20 Apr 2020 07:53:50 -0400

openssl (1.1.1f-1ubuntu1) focal; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - Replace duplicate files in the doc directory with symlinks.
    - debian/libssl1.1.postinst:
      + Display a system restart required notification on libssl1.1
        upgrade on servers.
      + Use a different priority for libssl1.1/restart-services depending
        on whether a desktop, or server dist-upgrade is being performed.
      + Bump version check to to 1.1.1.
      + Import libraries/restart-without-asking template as used by above.
    - Revert "Enable system default config to enforce TLS1.2 as a
      minimum" & "Increase default security level from 1 to 2".
    - Reword the NEWS entry, as applicable on Ubuntu.
    - Cherrypick s390x SIMD acceleration patches for poly1305 and chacha20
      and ECC from master.
    - Use perl:native in the autopkgtest for installability on i386.
    - Set OPENSSL_TLS_SECURITY_LEVEL=2 as compiled-in minimum security
      level. Change meaning of SECURITY_LEVEL=2 to prohibit TLS versions
      below 1.2 and update documentation. Previous default of 1, can be set
      by calling SSL_CTX_set_security_level(), SSL_set_security_level() or
      using ':@SECLEVEL=1' CipherString value in openssl.cfg.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 03 Apr 2020 18:31:00 +0100

openssl (1.1.1f-1) unstable; urgency=medium

  * New upstream version
   - Revert the change of EOF detection to avoid regressions in applications.
     (Closes: #955442).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Tue, 31 Mar 2020 23:59:59 +0200

openssl (1.1.1e-1) unstable; urgency=medium

  * Use dh-compat level 12.
  * New upstream version
    - CVE-2019-1551 (Overflow in the x64_64 Montgomery squaring procedure),
    (Closes: #947949).
  * Update symbol list.
  * Update Standards-Version to 4.5.0. No changes required.
  * Add musl configurations (Closes: #941765).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Wed, 18 Mar 2020 20:59:39 +0100

openssl (1.1.1d-2ubuntu6) focal; urgency=medium

  * Revert version number change to 1.1.1e-dev.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 06 Mar 2020 04:08:51 +0000

openssl (1.1.1d-2ubuntu4) focal; urgency=medium

  * Apply 1_1_1-stable branch patches
  * Apply s390x ECC assembly pack improvements

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 26 Feb 2020 21:54:47 +0000

openssl (1.1.1d-2ubuntu3) focal; urgency=medium

  * Use perl:native in the autopkgtest for installability on i386.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Thu, 16 Jan 2020 14:15:26 +0000

openssl (1.1.1d-2ubuntu2) focal; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - Replace duplicate files in the doc directory with symlinks.
    - debian/libssl1.1.postinst:
      + Display a system restart required notification on libssl1.1
        upgrade on servers.
      + Use a different priority for libssl1.1/restart-services depending
        on whether a desktop, or server dist-upgrade is being performed.
      + Bump version check to to 1.1.1.
      + Import libraries/restart-without-asking template as used by above.
    - Revert "Enable system default config to enforce TLS1.2 as a
      minimum" & "Increase default security level from 1 to 2".
    - Reword the NEWS entry, as applicable on Ubuntu.
    - Cherrypick s390x SIMD acceleration patches for poly1305 and chacha20
      from master.

  * Set OPENSSL_TLS_SECURITY_LEVEL=2 as compiled-in minimum security
    level. Change meaning of SECURITY_LEVEL=2 to prohibit TLS versions
    below 1.2 and update documentation. Previous default of 1, can be set
    by calling SSL_CTX_set_security_level(), SSL_set_security_level() or
    using ':@SECLEVEL=1' CipherString value in openssl.cfg.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 08 Jan 2020 17:17:41 +0000

openssl (1.1.1d-2) unstable; urgency=medium

  * Reenable AES-CBC-HMAC-SHA ciphers (Closes: #941987).

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Sat, 12 Oct 2019 21:37:55 +0200

openssl (1.1.1d-1) unstable; urgency=medium

  * New upstream version
   - CVE-2019-1549 (Fixed a fork protection issue).
   - CVE-2019-1547 (Compute ECC cofactors if not provided during EC_GROUP
     construction).
   - CVE-2019-1563 (Fixed a padding oracle in PKCS7_dataDecode and
     CMS_decrypt_set1_pkey).
  * Update symbol list

 -- Sebastian Andrzej Siewior <sebastian@breakpoint.cc>  Sat, 14 Sep 2019 00:38:12 +0200

# For older changelog entries, run 'apt-get changelog libssl1.1'
