matrix-synapse (0.24.0+dfsg-1ubuntu0.1~esm4) bionic-security; urgency=medium

  * debian/patches/CVE-2023-43796.patch: Remove reference to JsonDict

 -- John Breton <john.breton@canonical.com>  Thu, 17 Apr 2025 13:54:57 -0400

matrix-synapse (0.24.0+dfsg-1ubuntu0.1~esm3) bionic-security; urgency=medium

  * debian/patches/CVE-2023-32683.patch: Remove incompatible Python syntax

 -- John Breton <john.breton@canonical.com>  Thu, 17 Apr 2025 10:03:58 -0400

matrix-synapse (0.24.0+dfsg-1ubuntu0.1~esm2) bionic-security; urgency=medium

  * SECURITY UPDATE: Network policy bypass via oEmbed or image URLs
    - debian/patches/CVE-2023-32683.patch: Separate URL checker out to
      a separate method.
    - CVE-2023-32683
  * SECURITY UPDATE: Information leakage via cached device information
    - debian/patches/CVE-2023-43796.patch: Merge pull request from GHSA-
      mp92-3jfm-3575
    - CVE-2023-43796 

 -- John Breton <john.breton@canonical.com>  Mon, 14 Apr 2025 06:45:20 -0400

matrix-synapse (0.24.0+dfsg-1ubuntu0.1~esm1) bionic-security; urgency=medium

  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2019-18835.patch: fixed an issue with the signature
      checking in some modules
    - debian/patches/CVE-2018-12291.patch: fixed a security issue in the 
      get_missing_events function
    - debian/patches/CVE-2018-10657-[1-3].patch: fixed an issue resulting in
      denial of service in several modules
    - CVE-2019-18835
    - CVE-2018-12291
    - CVE-2018-10657
  * SECURITY UPDATE: Session Hijacking
    - debian/patches/CVE-2019-11842-[1-2].patch: fixed an issue in random
      number generation potentially letting the attacker to predict a Sydent
      authentication token or a Synapse random ID
    - debian/patches/CVE-2018-12423.patch: fixed a possible session hijack
      from unauthorised users
    - CVE-2019-11842
    - CVE-2018-12423
  * SECURITY UPDATE: Spoofing and Impersonation
    - debian/patches/CVE-2019-5885.patch: fixed a security issue in
      macaroon_secret_key potentially resulting in impersonating users
    - debian/patches/CVE-2018-16515.patch: fixed a security issue potentially
      resulting in spoofing
    - CVE-2019-5885
    - CVE-2018-16515

 -- Amir Naseredini <amir.naseredini@canonical.com>  Fri, 12 May 2023 17:54:44 +0100

matrix-synapse (0.24.0+dfsg-1) unstable; urgency=medium

  * New upstream version.
  * Remove an extra oversionmangle from debian/watch.
  * Drop a patch applied upstream.
  * Update debian/copyright.
  * Add a patch to temporarily avoid phonenumbers dependency.

 -- Andrew Shadura <andrewsh@debian.org>  Tue, 24 Oct 2017 15:25:33 +0100

matrix-synapse (0.19.2+dfsg-6) unstable; urgency=medium

  [ Simó Albert i Beltran ]
  * Use set -e instead of passes -e to hte shell on the #! at debian/postinst

  [ Rui Branco ]
  * Add Portuguese translation for debconf messages.

  [ Andrew Shadura ]
  * Temporarily add an optional dependency on python-pymacaroons-pynacl
    for python-nacl << 1.1.0.

 -- Andrew Shadura <andrewsh@debian.org>  Mon, 27 Mar 2017 11:52:05 +0200

matrix-synapse (0.19.2+dfsg-5) unstable; urgency=medium

  [ Simó Albert i Beltran ]
  * When purging remove configuration files created by debian/postinst
    (Closes: #857428)

  [ Helge Kreutzmann ]
  * Add initial German debconf translation. (Closes: #857526)

  [ Rahul De ]
  * Fail silently if server name is not configured (Closes: #857619)

 -- Andrew Shadura <andrewsh@debian.org>  Sat, 18 Mar 2017 11:14:06 +0100

matrix-synapse (0.19.2+dfsg-4) unstable; urgency=medium

  * Add bcrypt and pymacaroons to pydist-overrides so that the runtime
    dependencies are picked up automatically.

 -- Andrew Shadura <andrewsh@debian.org>  Fri, 10 Mar 2017 12:04:52 +0100

matrix-synapse (0.19.2+dfsg-3) unstable; urgency=medium

  * Add missing copyrights for jwt.py and saml2.py
    (Thanks to Andreas Henriksson).

 -- Andrew Shadura <andrewsh@debian.org>  Mon, 06 Mar 2017 20:53:50 +0100

matrix-synapse (0.19.2+dfsg-2) unstable; urgency=medium

  * Move to Section: net.
  * Add Vcs-*.
  * Add Homepage.
  * Use oversionmangle and dversionmangle in debian/watch.
  * Move Apache-2.0 license text into a separate paragraph.

 -- Andrew Shadura <andrewsh@debian.org>  Tue, 21 Feb 2017 18:32:09 +0100

matrix-synapse (0.19.2+dfsg-1) unstable; urgency=medium

  * Don't install upstream's minified jquery, depend on libjs-jquery.
  * Include the source code for jquery-2.1.3.min.js
  * Don't load reCAPTCHA.
  * Update debian/copyright.
  * Set repacksuffix, remove debian uupdate.
  * Actually add lsb-base as a dependency.

 -- Andrew Shadura <andrewsh@debian.org>  Tue, 21 Feb 2017 18:01:45 +0100

matrix-synapse (0.19.2-1) unstable; urgency=medium

  [ Sunil Mohan Adapa ]
  * Bump standards version to 3.9.8.
  * Don't ignore errors in debian/config.
  * Internationalise strings in the template file.
  * Add lsb-base as a dependency.
  * Update debconf questions.
  * Add manpages for all binaries.

  [ Andrew Shadura ]
  * New upstream version.
  * Update debian/copyright file.

 -- Andrew Shadura <andrewsh@debian.org>  Tue, 21 Feb 2017 16:14:52 +0100

matrix-synapse (0.19.1-1) unstable; urgency=medium

  [ Erik Johnston ]
  * Initial packaging for the upstream version 0.19.1.

  [ Andrew Shadura ]
  * First upload to Debian (Closes: #830601).

 -- Andrew Shadura <andrewsh@debian.org>  Tue, 21 Feb 2017 15:39:04 +0100
