libapache2-mod-auth-openidc (1.6.0-1+deb8u3) jessie-security; urgency=high

  * Non-maintainer upload by the LTS team.
  * CVE-2019-20479
    Insufficient validatation of URLs leads to an Open Redirect vulnerability
    for URLs beginning with a slash and backslash.

 -- Thorsten Alteholz <debian@alteholz.de>  Sat, 29 Feb 2020 11:03:02 +0100

libapache2-mod-auth-openidc (1.6.0-1+deb8u2) jessie-security; urgency=high

  * Non-maintainer upload by the LTS team.
  * Fix CVE-2019-14857:
    A security vulnerability was found in libapache2-mod-auth-openidc, the
    OpenID Connect authentication module for the Apache HTTP server.
    Insufficient validatation of URLs leads to an Open Redirect vulnerability.
    An attacker may trick a victim into providing credentials for an OpenID
    provider by forwarding the request to an illegitimate website.

 -- Markus Koschany <apo@debian.org>  Mon, 18 Nov 2019 14:40:00 +0100

libapache2-mod-auth-openidc (1.6.0-1+deb8u1) jessie-security; urgency=medium

  * Non-maintainer upload by the LTS Team.
  * CVE-2019-1010247
    The OIDCRedirectURI page contains generated JavaScript code that
    uses a poll parameter as a string variable, thus might contain
    additional JavaScript code.
    This might result in Criss-Site Scripting (XSS)

 -- Thorsten Alteholz <debian@alteholz.de>  Fri, 23 Aug 2018 20:03:02 +0200

libapache2-mod-auth-openidc (1.6.0-1) unstable; urgency=medium

  * new upstream release; add libssl-dev dependency

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Mon, 13 Oct 2014 12:23:35 +0200

libapache2-mod-auth-openidc (1.5.5-1) unstable; urgency=medium

  * use HttpOnly on cookies; set OIDCCookiePath to /

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Tue, 26 Aug 2014 09:23:43 +0200

libapache2-mod-auth-openidc (1.5.4-3) unstable; urgency=medium

  * changelog line was too long; correct/simplify watch file

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Thu, 14 Aug 2014 15:51:02 +0200

libapache2-mod-auth-openidc (1.5.4-2) unstable; urgency=medium

  * correct debian directory for wheezy/jessie; watch file check .orig.tar.gz

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Thu, 14 Aug 2014 15:03:52 +0200

libapache2-mod-auth-openidc (1.5.4-1) unstable; urgency=medium

  * fix big endian issue

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Thu, 14 Aug 2014 12:59:11 +0200

libapache2-mod-auth-openidc (1.5.3-2) unstable; urgency=medium

  * build/test on big endian arch

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Sun, 3 Aug 2014 22:27:07 +0200

libapache2-mod-auth-openidc (1.5.3-1) unstable; urgency=medium

  * fix initialization leak

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Fri, 1 Aug 2014 12:37:53 +0200

libapache2-mod-auth-openidc (1.5.2-1) unstable; urgency=medium

  * fix OAuth 2.0 authorization and passes JSON claims in HTTP headers

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Tue, 1 Jul 2014 15:22:38 +0200

libapache2-mod-auth-openidc (1.5.1-1) unstable; urgency=medium

  * add pkg-config to Build-Depends

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Thu, 12 Jun 2014 14:33:10 +0200

libapache2-mod-auth-openidc (1.5-6) unstable; urgency=medium

  * drop lintian-overrides

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Tue, 10 Jun 2014 13:36:02 +0200

libapache2-mod-auth-openidc (1.5-5) unstable; urgency=medium

  * support both Apache 2.2 and 2.4 config layouts

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Fri, 06 Jun 2014 19:05:59 +0200

libapache2-mod-auth-openidc (1.5-4) unstable; urgency=medium

  * include .postinst script for setting permissions

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Fri, 06 Jun 2014 18:07:12 +0200

libapache2-mod-auth-openidc (1.5-3) unstable; urgency=medium

  * more Debian packaging fixes

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Fri, 06 Jun 2014 13:46:56 +0200

libapache2-mod-auth-openidc (1.5-2) unstable; urgency=medium

  * include original source

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Thu, 05 Jun 2014 21:05:12 +0200

libapache2-mod-auth-openidc (1.5-1) unstable; urgency=medium

  * use Debian non-native packaging

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Thu, 05 Jun 2014 20:32:44 +0200

libapache2-mod-auth-openidc (1.5) unstable; urgency=medium

  * switch to JSON parser jansson

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Thu, 05 Jun 2014 11:11:25 +0200

libapache2-mod-auth-openidc (1.4) unstable; urgency=medium

  * OpenSSL fixes

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Mon, 02 Jun 2014 13:43:50 +0200

libapache2-mod-auth-openidc (1.3) unstable; urgency=medium

  * fix running on non-standard port

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Tue, 20 May 2014 10:51:29 +0200

libapache2-mod-auth-openidc (1.2) unstable; urgency=medium

  * session timeout handling, use shared memory as cache by default

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Tue, 22 Apr 2014 13:54:07 +0200

libapache2-mod-auth-openidc (1.1) unstable; urgency=low

  * add issuer to REMOTE_USER; included INSTALL

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Thu, 03 Apr 2014 19:28:31 +0200

libapache2-mod-auth-openidc (1.0.1) unstable; urgency=low

  * fix Require keyword issue for Apache 2.4

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Fri, 28 Mar 2014 22:33:07 +0100

libapache2-mod-auth-openidc (1.0) unstable; urgency=low

  * Initial release under new name and flag.

 -- Hans Zandbelt <hzandbelt@pingidentity.com>  Thu, 27 Mar 2014 20:47:00 +0100
