libmina-sshd-java (2.19.0-1) unstable; urgency=medium

  * New upstream version 2.19.0:
    Fixes the following CVE:
    - CVE-2026-48827:
    Path traversal vulnerability in Apache MINA SSHD bundle sshd-git.
    Lack of path validation in git-upload-pack, git-receive-pack, and
    other git operations allows users authenticated over SSH access to
    git repositories outside the configured git server root directory.
    Applications are affected if they use org.apache.sshd:sshd-git.
    Applications not using sshd-git are not affected.
    - CVE-2026-56452:
    Path traversal in the sshd-scp component of Apache MINA SSHD. Apache
    MINA SSHD is a Java library for client-side and server-side SSH.
    The implementation of receiving files or directories via SCP did not
    validate filenames in SCP "C" or "D" commands. A malicious sender
    could send filenames containing paths, resulting in files to be
    written in attacker-controlled places.
    - CVE-2026-56624:
    Improper certificate validation in Apache MINA SSHD (server-
    side). Apache MINA SSHD is a Java library for client-side and
    server-side SSH.     Server-side OpenSSH user certificate validation
    during user authentication in an Apache MINA SSHD server did not
    check for the unsupported force-command or verify-required options
    that could be embedded in the certificate, nor did it validate these
    options. As a result it was possible that a user could authenticate
    with such a certificate that included a force-command option but
    still was able to execute other commands. What other command exactly
    would be available to the user depends on the implementation of the
    server.
    - CVE-2026-58624:
    Improper input validation in sshd-git in Apache MINA SSHD. Apache
    MINA SSHD is a Java library for client-side and server-side SSH.
    Component org.apache.sshd:sshd-git provides though its
    GitPgmCommandFactory a way to configure an Apache MINA SSHD server
    such that SSH clients can remotely execute git commands via the JGit
    library on git repositories stored on the server.     This
    GitPgmCommandFactory allowed a user authenticated via SSH to run any
    JGit command available, including commands that could write files at
    arbitrary places such as git archive with the --output option.
    Affected are SSH servers implemented with Apache MINA SSHD and using
    the GitPgmCommandFactory. If the GitPgmCommandFactory is not
    configured on the server, the server is not affected.
    (Closes: #1138634, #1142679)
  * Refreshing patches
  * Switching to debhelper-compat 14, removing misc: substvar
  * Raising Standards version to 4.7.4:
    - Removing Priority: optional, which is now defaults
    - Removing R-R-R: no, which is now defaults
  * Raising d/watch version to 5
  * Skipping second and identical run of tests with mina 2.2.x
  * Skipping additional classpath requirements of bouncycastle fips classes
  * B-D on junit5
  * Updating versioned B-D on libapacheds-java
  * Updating the list of POM files
  * Patching out more tests requiring unpackaged org.testcontainers

 -- Pierre Gruet <pgt@debian.org>  Wed, 04 Nov 2026 21:31:50 +0100

libmina-sshd-java (2.13.2-3) unstable; urgency=medium

  * Raising Standards version to 4.7.2 (no change)
  * Removing the nocheck annotation for the B-D mockito (Closes: #1116772)

 -- Pierre Gruet <pgt@debian.org>  Sat, 04 Oct 2025 22:40:46 +0200

libmina-sshd-java (2.13.2-2) unstable; urgency=medium

  * Looping over FileStore's instead of using getFileStore(Path), thanks to
    Pushkar Kulkarni and Santiago Vila! (Closes: #1074355)

 -- Pierre Gruet <pgt@debian.org>  Thu, 23 Jan 2025 00:11:22 +0100

libmina-sshd-java (2.13.2-1) unstable; urgency=medium

  * New upstream version 2.13.2
  * Refreshing patches
  * Adding a versioned B-D on libjsch-java which has switched upstream
  * Managing test dependencies and test artifacts more thoroughly, using
    Maven classifiers
  * Skipping second runs of some tests as some issues have been identified
    upstream with reruns
  * Rules-Requires-Root: no in d/control

 -- Pierre Gruet <pgt@debian.org>  Sun, 22 Sep 2024 22:40:07 +0200

libmina-sshd-java (2.12.1-2) unstable; urgency=medium

  * Source-only upload to unstable

 -- Pierre Gruet <pgt@debian.org>  Mon, 13 May 2024 20:10:58 +0200

libmina-sshd-java (2.12.1-1) experimental; urgency=medium

  * Initial release (Closes: #683639)

 -- Pierre Gruet <pgt@debian.org>  Mon, 06 May 2024 10:31:16 +0200
