libapache-mod-jk (1:1.2.50-1) unstable; urgency=medium

  * New upstream version 1.2.50. (Closes: #1094590)
    - Fix CVE-2024-46544:
      Incorrect default permissions for the memory mapped file configured by
      the JkShmFile directive on Unix like systems allows local users to view
      and/or modify the contents of the shared memory containing mod_jk
      configuration and status information. This could result in information
      disclosure and/or denial of service. (Closes: #1082713)
  * Declare compliance with Debian Policy 4.7.0.

 -- Markus Koschany <apo@debian.org>  Sat, 08 Feb 2025 20:59:37 +0100

libapache-mod-jk (1:1.2.49-1) unstable; urgency=high

  * New upstream version 1.2.49.
    - Fix CVE-2023-41081:
      The mod_jk component of Apache Tomcat Connectors in some circumstances,
      such as when a configuration included "JkOptions +ForwardDirectories" but
      the configuration did not provide explicit mounts for all possible
      proxied requests, mod_jk would use an implicit mapping and map the
      request to the first defined worker. Such an implicit mapping could
      result in the unintended exposure of the status worker and/or bypass
      security constraints configured in httpd. As of JK 1.2.49, the implicit
      mapping functionality has been removed and all mappings must now be via
      explicit configuration. (Closes: #1051956)
      Thanks to Salvatore Bonaccorso for the report.

 -- Markus Koschany <apo@debian.org>  Fri, 15 Sep 2023 00:25:01 +0200

libapache-mod-jk (1:1.2.48-2) unstable; urgency=medium

  * Declare compliance with Debian Policy 4.6.2.
  * Suggest tomcat10 instead of tomcat9.

 -- Markus Koschany <apo@debian.org>  Sat, 18 Feb 2023 19:17:18 +0100

libapache-mod-jk (1:1.2.48-1) unstable; urgency=medium

  * New upstream version 1.2.48.
  * Switch to debhelper-compat = 13.
  * Declare compliance with Debian Policy 4.5.0.
  * Use canonical VCS URI.
  * Suggest only the most recent version of tomcat.
  * Build-depend on default-jdk and ant to build the documentation.
  * Change the logic for building the documentation from source. Use ant.
  * Install the NOTICE file.
  * Drop 0001-disable-logo.patch and fix-privacy-breach.patch. Fixed upstream.

 -- Markus Koschany <apo@debian.org>  Thu, 04 Jun 2020 21:42:29 +0200

libapache-mod-jk (1:1.2.46-2) unstable; urgency=medium

  * Rename httpd-jk.conf to jk.conf to restore compatibility with Debian's
    Apache helpers a2enmod and a2dismod. (Closes: #928813)

 -- Markus Koschany <apo@debian.org>  Wed, 27 May 2020 19:19:20 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libapache2-mod-jk`.
