puma (3.12.4-1ubuntu2+esm1) focal-security; urgency=medium

  * SECURITY UPDATE: HTTP Smuggling
    - debian/patches/CVE-2020-11076.patch: better handle client input.
    - CVE-2020-11076
  * SECURITY UPDATE: HTTP Smuggling
    - debian/patches/CVE-2020-11077-1.patch: reduce ambiguity of headers.
    - debian/patches/CVE-2020-11077-2.patch: adjust test to match real
      world value.
    - CVE-2020-11077
  * SECURITY UPDATE: information leakage
    - debian/patches/CVE-2022-23634.patch: call `close` on the response
      body whatever the cases to avoid information leakage.
    - CVE-2022-23634
  * SECURITY UPDATE: HTTP Smuggling
    - debian/patches/CVE-2022-24790.patch: fix parsing of malformed
      Content-Length and reject unsupported encoding in Transfer-Encoding
      to stop malicious requests.
    - debian/patches/CVE-2022-24790-tests-backport.patch: backport tests.
    - CVE-2022-24790
  * SECURITY UPDATE: HTTP Smuggling
    - debian/patches/CVE-2023-40175.patch: reject empty string for
      Content-Length and ignore trailers in last chunk.
    - CVE-2023-40175
  * SECURITY UPDATE: Uncontrolled Resource Consumption
    - debian/patches/CVE-2024-21647.patch: limit the size of chunk
      extensions.
    - CVE-2024-21647
  * pull-1508.patch, pull-1812.patch, pull-2496.patch, pull-2326.patch:
    backport essential commits from upstream for the patches, mostly
    about chunking.
    - lib/puma/client.rb: decode_chunk(), setup_chunked_body().
    - test/test_puma_server.rb: tests for added chunking capabilities.

 -- Allen Huang <allen.huang@canonical.com>  Fri, 23 Feb 2024 10:35:14 +0000

puma (3.12.4-1ubuntu2) focal; urgency=medium

  - Merge from Debian unstable.  Remaining changes:
    - Disable a test that fails on Ubuntu builder farm, but not locally
      (LP: #1866881).

 -- Lucas Kanashiro <lucas.kanashiro@canonical.com>  Tue, 10 Mar 2020 15:46:46 -0300

puma (3.12.4-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
    - Fixes CVE-2020-5247 (closes: #952766).
    - Fixes CVE-2020-5249 (closes: #953122).
  * d/control (Section): Changed to web.
    (Homepage): Use secure URL.
    (Depends): Add ${ruby:Depends}.
  * d/copyright (Source): Use secure URL.
  * d/ruby-tests.rake: Disable test/test_puma_server_ssl.rb for the moment.
    These tests fail due to openssl being configured to use SECLEVEL2
    (https://github.com/puma/puma/issues/2147).
  * d/rules: Add override to install upstream changelog.
  * d/watch: Rename downloaded tarball to include package name.
  * d/patches/0008-fix-ssl-tests.patch: Remove patch. Applied upstream.
  * d/patches/CVE-2019-16770.patch: Ditto.
  * d/patches/*.patch: Refresh patches.
  * d/patches/series: Adjust.

 -- Daniel Leidert <dleidert@debian.org>  Wed, 04 Mar 2020 23:09:16 +0100

puma (3.12.0-4ubuntu1) focal; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - Disable a test that fails on Ubuntu builder farm, but not locally

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Fri, 07 Feb 2020 11:02:15 +0100

puma (3.12.0-4) unstable; urgency=medium

  * Team upload.
  * d/control (Rules-Requires-Root): Set to binary-targets.
  * d/patches/0011-disable-minitest-extensions.patch: Add patch.
    - Disable unavailable minitest retry extension.
  * d/patches/CVE-2019-16770.patch: Add patch.
    - Backport fix for CVE-2019-16770 from upstream (closes: #946312).
  * d/patches/series: Add patch.

 -- Daniel Leidert <dleidert@debian.org>  Thu, 06 Feb 2020 12:54:59 +0100

puma (3.12.0-3) unstable; urgency=medium

  * Team upload.
  * d/compat: Remove obsolete file.
  * d/control: Add Rules-Requires-Root field.
    (Build-Depends): Use debhelper-compat.
    (Standards-Version): Bump to 4.5.0.
    (Depends): Drop ruby-interpreter.
  * d/copyright (Format): Fix insecure-copyright-format-uri and add myself.
  * d/puma.1, d/pumactl.1: Add manual pages.
  * d/puma.manpages: Install manual pages.
  * d/ruby-tests.rake: Set verbose mode.
  * d/patches/0010-fix-cluster-exit-for-ruby27.patch: Add patch.
    - Fix hang with Ruby >= 2.6 when shutting down workers.
  * d/patches/series: Enable new patch.
  * d/upstream/metadata: Add metadata.

 -- Daniel Leidert <dleidert@debian.org>  Wed, 05 Feb 2020 18:20:58 +0100

puma (3.12.0-2ubuntu1) disco; urgency=medium

  * Disable a test that fails on Ubuntu builder farm, but not locally

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Sat, 13 Apr 2019 16:25:42 +0200

puma (3.12.0-2) unstable; urgency=medium

  * Disable tests failing in single cpu (Closes: #921931)

 -- Pirate Praveen <praveen@debian.org>  Sun, 10 Feb 2019 18:56:47 +0530

puma (3.12.0-1) unstable; urgency=medium

  [ Balint Reczey ]
  * New upstream version 3.12.0
  * Refresh patches

  [ Pirate Praveen ]
  * Fix OpenSSL 1.1.1 test failures with upstream patch (Closes: #900156)
  * Bump Standards-Version to 4.3.0 (no changes needed)
  * Add myself to uploaders

 -- Pirate Praveen <praveen@debian.org>  Sun, 10 Feb 2019 10:56:59 +0530

puma (3.11.3-1) unstable; urgency=medium

  * Team upload
  * Remove myself from Uploaders:
  * New upstream version 3.11.3
  * Build against libssl-dev instead of libssl1.0-dev (Closes: #859542)
  * Refresh packaging files with `dh-make-ruby -wo .`
    * Bump debhelper compat to 11
    * Change Vcs-* to point to salsa.debian.org
    * Use standard debian/ruby-tests.rake
      * drop build-dependency on ruby-hoe
  * Refresh patches
  * New patches:
    - 0006-test-helper.rb-drop-bundler-usage.patch
    - 0007-test-test_cli.rb-disable-test-that-fails-randomly.patch
  * Replace 0001-test_puma_server_ssl-update-for-newer-versions-of-Op.patch
    with 0001-test_puma_server_ssl-disable-test-that-takes-too-lon.patch


 -- Antonio Terceiro <terceiro@debian.org>  Wed, 28 Mar 2018 18:53:22 -0300

puma (3.6.0-1) unstable; urgency=medium

  * Initial release (Closes: #720336)

 -- Antonio Terceiro <terceiro@debian.org>  Thu, 10 Nov 2016 16:47:06 -0200
