shiro (1.3.2-6ubuntu2) resolute; urgency=medium

  * No-change mass rebuild for Ubuntu 26.04 (LP: #2132257)

 -- Sebastien Bacher <seb128@debian.org>  Thu, 29 Jan 2026 22:17:16 +0100

shiro (1.3.2-6ubuntu1) plucky; urgency=medium

  * Merge from Debian Unstable. Remaining changes:
    - SECURITY UPDATE: Path traversal through path rewriting and Open Redirect
      with form authentication.
      + debian/patches/CVE-2023-34478.patch: Check for path traversal values in
        .../web/filter/InvalidRequestFilter.java.
      + debian/patches/CVE-2023-467xx.patch: Extend path traversal checking
        values in .../web/filter/InvalidRequestFilter.java.
      + CVE-2023-34478
      + CVE-2023-46749
      + CVE-2023-46750

 -- Simon Quigley <tsimonq2@ubuntu.com>  Wed, 19 Feb 2025 21:06:18 -0600

shiro (1.3.2-6) unstable; urgency=medium

  * Depend on libservlet-api-java instead of libservlet3.1-java
  * Ignore the deprecated guice-multibindings dependency
  * Standards-Version updated to 4.7.0
  * Switch to debhelper level 13

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 17 Dec 2024 15:36:48 +0100

shiro (1.3.2-5ubuntu1) plucky; urgency=medium

  * SECURITY UPDATE: Path traversal through path rewriting and Open Redirect
    with form authentication.
    - debian/patches/CVE-2023-34478.patch: Check for path traversal values in
      .../web/filter/InvalidRequestFilter.java.
    - debian/patches/CVE-2023-467xx.patch: Extend path traversal checking
      values in .../web/filter/InvalidRequestFilter.java.
    - CVE-2023-34478
    - CVE-2023-46749
    - CVE-2023-46750

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 09 Dec 2024 14:36:39 -0330

shiro (1.3.2-5) unstable; urgency=medium

  * Team upload.
  * Update patch for Spring Framework 4.3.x build failure.
  * Cherry-pick upstream patch with Guice improvements.
  * CVE-2020-1957: Fix a path-traversal issue where a specially-crafted request
    could cause an authentication bypass. (Closes: #955018)
  * CVE-2020-11989: Fix an encoding issue introduced in the handling of the
    previous CVE-2020-1957 path-traversal issue which could have also caused an
    authentication bypass.
  * CVE-2020-13933: Fix an authentication bypass resulting from a specially
    crafted HTTP request. (Closes: #968753)
  * CVE-2020-17510: Fix an authentication bypass resulting from a specially
    crafted HTTP request.

 -- Roberto C. Sánchez <roberto@debian.org>  Fri, 27 Aug 2021 13:10:19 -0400

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libshiro-java`.
