# changelog

author: andreas.stieger@gmx.de
changelog:
  - Update to 5.4.1:
    * Bug 5055: FATAL FwdState::noteDestinationsEnd exception: opening
    * code clean-ups and developer visible changes


author: adam.majer@suse.de
changelog:
  - Fix upgrade path from squid 4.x where we replaced some symlinks
    with directories in pretrans section (bsc#1197333)
  - old_nettle_compat.patch: refresh patch


author: adam.majer@suse.de
changelog:
  - Update to 5.6:
    * Improve handling of Gopher responses (bsc#1200907, CVE-2021-46784)
  - Changes in 5.5:
    * fixes regression Bug 5192: esi_parser default is incorrect
    * Bug 5177: clientca certificates sent to https_port clients
    * Bug 5090: Must(!request->pinnedConnection()) violation
    * Kid restart leads to persistent queue overflows, delays/timeouts


author: schubi@suse.com
changelog:
  - Moved logrotate files from user specific directory /etc/logrotate.d
    to vendor specific directory /usr/etc/logrotate.d.


author: chris@computersalat.de
changelog:
  - fix PIDFile
    * NOT needed in service file
      (squid.service: Can't open PID file /run/squid.pid)
    * placed to tmpfilesdir


author: dmueller@suse.com
changelog:
  - update to 5.7:
    - Regression Fix: Typo in manager ACL (bsc#1203677, CVE-2022-41317)
    - Bug 5186: noteDestinationsEnd check failed: transportWait
    - Bug 5160: Test suite fails with -flto=auto
    - Bug 3193 pt2: NTLM decoder truncating strings
      (bsc#1203680, CVE-2022-41318)
    - Bug 5133: OpenSSL 3.0 support
    - ext_session_acl: fix TDB key lookup
    - forward_max_tries: Do not count discarded connections
    - ... and many compile and debugging fixes


author: schubi@suse.com
changelog:
  - Migration to /usr/etc: Saving user changed configuration files
    in /etc and restoring them while an RPM update.


author: adam.majer@suse.de
changelog:
  - partial revert of earlier "fix PIDFile"
    - move pidfile back to /run/squid.pid and not in the directory
      owned by squid. The purpose of /run/squid/ is to facilitate
      SMP worker's IPC and not for the PID file. The PID file can
      live just fine in /run since it's written by root. (bsc#1210960)


author: adam.majer@suse.de
changelog:
  - SQUID-2023_1.patch: Request/Response smuggling in HTTP/1.1 and ICAP
    (bsc#1216500, CVE-2023-46846)
  - SQUID-2023_3.patch: Denial of Service in HTTP Digest Authentication
    (bsc#1216495, CVE-2023-46847)
  - SQUID-2023_4.patch: Fix validation of certificates with CN=*
    (bsc#1216803, CVE-2023-46724)
  - SQUID-2023_5.patch: Denial of Service in FTP
    (bsc#1216498, CVE-2023-46848)


author: adam.majer@suse.de
changelog:
  - SQUID-2023_7.patch - fix buffer overread bug on HTTP Message
    processing flow (bsc#1217813, CVE-2023-49285)
  - SQUID-2023_8.patch - fix Denial of Service vulnerability in
    helper process management (bsc#1217815, CVE-2023-49286)
  - old_nettle_compat.patch: dropped as unused.
  - converted to autopatch


author: adam.majer@suse.de
changelog:
  - SQUID-2023_11.patch: fix Denial of Service attack against
    Cache Manager error responses (bsc#1219131, CVE-2024-23638)


author: info@paolostivanin.com
changelog:
  - Update to 5.4:
    * Bug 5190: Preserve configured order of intermediate CA certificate chain
    * Bug 5188: Fix reconfiguration leaking tls-cert=... memory
    * Bug 5187: Properly track (and mark) truncated store entries
    * Bug 5134: assertion failed: Transients.cc:221: "old == e"
    * Bug 5132: Close the tunnel if to-server conn closes after client


