awstats (7.6+dfsg-2ubuntu0.18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: cross site scripting
    - debian/patches/CVE-2022-46391.patch: fix XSS in hostinfo plugin due to
      printing whois response without proper checks.
    - CVE-2022-46391

 -- Fabian Toepfer <fabian.toepfer@canonical.com>  Mon, 27 Feb 2023 21:32:47 +0100

awstats (7.6+dfsg-2ubuntu0.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Path traversal
    - debian/patches/CVE-2020-29600.patch: Disable parsing arbitrary files in
      wwwroot/cgi-bin/awstats.pl, introduced by an incomplete fix for
      CVE-2017-1000501.
    - CVE-2020-29600
  * SECURITY UPDATE: Path traversal 
    - debian/patches/CVE-2020-35176.patch: Disable parsing /etc/ dir in
      wwwroot/cgi-bin/awstats.pl, introduced by an incomplete fix for
      CVE-2017-1000501.
    - CVE-2020-35176

 -- Avital Ostromich <avital.ostromich@canonical.com>  Mon, 19 Apr 2021 21:27:22 -0400

awstats (7.6+dfsg-2) unstable; urgency=medium

  * QA upload.
  * Set maintainer to the QA team.
  * Import fixes from Ubuntu.
    + CVE-2017-1000501, closes: #885835
    + but the fix for #858461 is incomplete
  * Drop ancient versioned Recommends on an essential package.

 -- Adam Borowski <kilobyte@angband.pl>  Fri, 02 Feb 2018 02:21:35 +0100

awstats (7.6+dfsg-1ubuntu2) bionic; urgency=medium

  [ Christian Ehrhardt ]
  * debian/README.Debian, debian/prerotate.sh: fix logrotate integration due to
    change of www-data to /usr/sbin/nologin (a step towards #858461, LP: #1708665)

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 15 Dec 2017 18:55:12 -0200

awstats (7.6+dfsg-1ubuntu1) bionic; urgency=medium

  * SECURITY UPDATE: code execution via path traversal flaws
    - debian/patches/CVE-2017-1000501-1.patch: sanitize values in
      wwwroot/cgi-bin/awstats.pl.
    - debian/patches/CVE-2017-1000501-2.patch: sanitize more values in
      wwwroot/cgi-bin/awstats.pl.
    - CVE-2017-1000501

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 05 Jan 2018 07:35:35 -0500

awstats (7.6+dfsg-1) unstable; urgency=medium

  * Imported Upstream version 7.6+dfsg
  * Refresh patches
  * Bump up Standards-Version (to 3.9.8)
  * Fix spelling in README.Debian

 -- Sergey B Kirpichev <skirpichev@gmail.com>  Mon, 12 Dec 2016 13:51:39 +0300

awstats (7.5+dfsg-1) unstable; urgency=medium

  * Fix FTBFS (when built twice in a row): remove
    awgraphapplet-*.jar in the clean target
  * Fix encoding in German translation (Closes: #789361,
    thanks to Thorsten Glaser)
  * Imported Upstream version 7.5+dfsg
  * Refresh patches

 -- Sergey B Kirpichev <skirpichev@gmail.com>  Mon, 09 May 2016 16:20:22 +0300

awstats (7.4+dfsg-1) unstable; urgency=medium

  * Imported Upstream version 7.4+dfsg
  * Remove patches, applied by upstream
  * Refresh patches
  * Adopt debian/awstats.docs for new README name
  * Update installation instructions (Closes: #756501)
  * Use the upstream version in the path name for awgraphapplet.jar

 -- Sergey B Kirpichev <skirpichev@gmail.com>  Mon, 27 Jul 2015 13:56:07 +0300

awstats (7.3+dfsg-1) unstable; urgency=medium

  * Remove donation link in index.html (fix lintian
    E: privacy-breach-donation) in favor of debian/upstream/metadata
  * Install prerotate script (Closes: #714231)
  * Imported Upstream version 7.3+dfsg
  * Refresh patches
  * Add/cleanup Forwarded: patch headers
  * Fix permissions
  * Removed Facebook's Share/Like buttons (fix
    lintian E:privacy-breach-facebook)
  * Remove external image links for paypal donation (lintian
    E: privacy-breach-donation)
  * Removed twitter and google plus js (privacy breach)
  * Removed google search js (privacy breach)
  * removed pixel.gif
  * Set Forwarded: no for privacy patches
  * debian/upstream -> debian/upstream/metadata
  * Override lintian: debian-watch-may-check-gpg-signature and
    source-contains-prebuilt-java-object
  * Replace awstats_logo6.png by symlink
  * Bump up Standards-Version (to 3.9.6)

 -- Sergey B Kirpichev <skirpichev@gmail.com>  Mon, 27 Oct 2014 21:32:34 +0300

awstats (7.2+dfsg-1) unstable; urgency=low

  * Repackage upstream sources with uscan
  * Adopt README.source for new release
  * Imported Upstream version 7.2+dfsg
  * Refresh patches
  * Upgrade licences (upstream and debian/) to GPL v3+.
  * Fix lintian error: vcs-field-not-canonical

 -- Sergey B Kirpichev <skirpichev@gmail.com>  Sat, 16 Nov 2013 14:57:22 +0400

# For older changelog entries, run 'apt-get changelog awstats'
