tomcat8 (8.5.39-1ubuntu1~18.04.3) bionic-security; urgency=medium

  * SECURITY UPDATE: XSS attack on SSI printenv command
    - debian/patches/CVE-2019-0221.patch: escape debug output to aid
      readability
    - CVE-2019-0221   
  * SECURITY UPDATE: DoS via thread exhaustion
    - debian/patches/CVE-2019-10072-1.patch: expand HTTP/2 timeout 
      handling to connection window exhaustion on write.
    - debian/patches/CVE-2019-10072-2.patch: Fix test failures. Handle
      full allocation case.
    - CVE-2019-10072 

 -- Emilia Torino <emilia.torino@canonical.com>  Mon, 09 Sep 2019 16:47:51 -0300

tomcat8 (8.5.39-1ubuntu1~18.04.2) bionic; urgency=medium

  * debian/tomcat8-instance-create: update regex to account for the fact that
    the shutdown port is set to 8005 as default. LP: #1827090.

 -- Tiago Stürmer Daitx <tiago.daitx@ubuntu.com>  Thu, 09 May 2019 13:50:49 +0000

tomcat8 (8.5.39-1ubuntu1~18.04.1) bionic; urgency=medium

  [ Matthias Klose ]
  * Backport for OpenJDK 11. LP: #1817567.
    /usr/share/doc/tomcat8/NEWS.gz. LP: #1819721.

  [ Tiago Stürmer Daitx ]
  * debian/tomcat8.service: removed, use the init.d script instead.
    LP: #1819721.
  * debian/tomcat8.init, debian/logging.properties: revert back to the
    conffiles from the previous version; this allows unattended-upgrades
    to update tomcat8 even when local changes are present.
  * debian/series: no longer apply 0023-disable-shutdown-by-socket.patch
    so server.xml conffile is unmodified from previous version.

 -- Tiago Stürmer Daitx <tiago.daitx@ubuntu.com>  Wed, 10 Apr 2019 04:45:09 +0000

tomcat8 (8.5.39-1ubuntu1) disco; urgency=medium

  * Merge with Debian; remaining changes:
    - d/control: Break/replace tomcat8.0 binaries.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 26 Mar 2019 12:10:55 +0100

tomcat8 (8.5.39-1) experimental; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
  * Track and download the new releases from GitHub

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 25 Mar 2019 10:47:43 +0100

tomcat8 (8.5.38-2ubuntu1) disco; urgency=medium

  * Merge with Debian; remaining changes:
    - d/control: Break/replace tomcat8.0 binaries.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 27 Feb 2019 09:13:46 +0100

tomcat8 (8.5.38-2) unstable; urgency=high

  * Team upload.
  * Apply upstream patch to unbreak the startup script (Closes: #922863)

 -- Thorsten Glaser <tg@mirbsd.de>  Tue, 26 Feb 2019 21:37:51 +0100

tomcat8 (8.5.38-1ubuntu1) disco; urgency=medium

  * Merge with Debian unstable (LP: #1815601). Remaining changes:
    - d/control: Break/replace tomcat8.0 binaries. (LP: 1717998)
  Dropped Changes:
    - support-jre8.diff.

 -- Karl Stenerud <kstenerud@gmail.com>  Tue, 12 Feb 2019 14:11:03 +0100

tomcat8 (8.5.38-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 08 Feb 2019 15:27:17 +0100

tomcat8 (8.5.37-2) unstable; urgency=medium

  * Team upload.
  * No longer build the JavaEE API packages
  * Standards-Version updated to 4.3.0

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 15 Jan 2019 01:01:24 +0100

# For older changelog entries, run 'apt-get changelog libtomcat8-java'
