tomcat8 (8.5.30-1ubuntu1.4) bionic-security; urgency=medium

  * SECURITY UPDATE:
   - CVE-2018-1336: A bug in the UTF-8 decoder can lead to DoS
   - CVE-2018-8034: host name verification missing in WebSocket client
   - CVE-2018-8037: Information Disclosure

 -- Thomas Opfer <ubuntuone@thomasopfer.de>  Mon, 13 Aug 2018 22:23:56 +0200

tomcat8 (8.5.30-1ubuntu1.3) bionic; urgency=medium

  * Search for Java 10 and 11 runtimes (LP: #1780345)

 -- Stefano Rivera <stefanor@debian.org>  Mon, 16 Jul 2018 20:41:29 -0700

tomcat8 (8.5.30-1ubuntu1.2) bionic-security; urgency=medium

  * SECURITY UPDATE: CORS filter has insecure defaults
    - debian/patches/CVE-2018-8014.patch: change defaults in
      java/org/apache/catalina/filters/CorsFilter.java,
      java/org/apache/catalina/filters/LocalStrings.properties,
      test/org/apache/catalina/filters/TestCorsFilter.java,
      test/org/apache/catalina/filters/TesterFilterConfigs.java.
    - CVE-2018-8014

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 30 May 2018 09:37:13 -0400

tomcat8 (8.5.30-1ubuntu1.1) bionic; urgency=medium

  * support-jre8.diff: Fix running tomcat with JRE8. (LP: #1765616)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 24 Apr 2018 23:47:45 +0300

tomcat8 (8.5.30-1ubuntu1) bionic; urgency=medium

  * control: Break/replace tomcat8.0 binaries. (LP: #1717998)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 19 Apr 2018 14:53:19 +0300

tomcat8 (8.5.30-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.1.4

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 12 Apr 2018 09:49:28 +0200

tomcat8 (8.5.29-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 12 Mar 2018 16:43:57 +0100

tomcat8 (8.5.28-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Disabled the tests checking the ARIA cipher since it isn't enabled
      by default in OpenSSL
  * Standards-Version updated to 4.1.3
  * Switch to debhelper level 11
  * Use a secure URL for checking and downloading the new releases
  * No longer parse dpkg-parsechangelog in debian/rules

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 16 Feb 2018 13:43:01 +0100

tomcat8 (8.5.24-2) unstable; urgency=medium

  * Team upload.
  * Removed the setDefaultAsyncSendTimeout method mistakenly added to
    javax.websocket.WebSocketContainer in the version 8.5.24 (Closes: #884046)

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 14 Dec 2017 12:35:33 +0100

tomcat8 (8.5.24-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.1.2

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 01 Dec 2017 09:20:18 +0100

# For older changelog entries, run 'apt-get changelog libservlet3.1-java-doc'
