tomcat9 (9.0.31-1) unstable; urgency=medium

  * New upstream release
    - Fixes CVE-2019-10072: Denial of Service (Closes: #930872)
    - Fixes CVE-2019-12418: Local Privilege Escalation
    - Fixes CVE-2019-17563: Session fixation attack
    - Fixes CVE-2019-17569: HTTP Request Smuggling
    - Fixes CVE-2020-1935: HTTP Request Smuggling
    - Fixes CVE-2020-1938: AJP Request Injection (Closes: #952437)
    - Fixes CATALINA_PID handling in catalina.sh (Closes: #948553)
    - Refreshed the patches
    - Fixed the compilation with Java 11
  * Moved the RequiresMountsFor directive in the service file
    to the Unit section (Closes: #942316)
  * Tightened the dependency on systemd (Closes: #931997)
  * Standards-Version updated to 4.5.0

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 24 Feb 2020 23:37:00 +0100

tomcat9 (9.0.27-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.4.1

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 14 Oct 2019 11:31:50 +0200

tomcat9 (9.0.24-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 22 Aug 2019 13:55:14 +0200

tomcat9 (9.0.22-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Track and download the new releases from GitHub
  * Standards-Version updated to 4.4.0

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 12 Jul 2019 15:01:28 +0200

tomcat9 (9.0.16-4) unstable; urgency=medium

  * Team upload.

  [ Emmanuel Bourg ]
  * Fixed CVE-2019-0221: The SSI printenv command echoes user provided data
    without escaping and is, therefore, vulnerable to XSS. SSI is disabled
    by default (Closes: #929895)

  [ Thorsten Glaser ]
  * Remove -XX:+UseG1GC from standard JAVA_OPTS; the JRE chooses
    a suitable GC automatically anyway (Closes: #925928)
  * Correct the ownership and permissions on the log directory:
    group adm and setgid (Closes: #925929)
  * Make the startup script honour the (renamed) $SECURITY_MANAGER
  * debian/libexec/tomcat-locate-java.sh: Remove shebang and make
    not executable as this is only ever sourced (makes no sense otherwise)

  [ Christian Hänsel ]
  * Restored the variable expansion in /etc/default/tomcat9 (Closes: #926319)

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 13 Jun 2019 23:26:12 +0200

tomcat9 (9.0.16-3) unstable; urgency=medium

  * Removed read/write access to /var/lib/solr (Closes: #923299)
  * Removed the broken catalina-ws.jar and catalina-jmx-remote.jar
    symlinks in /usr/share/tomcat9/lib/

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 26 Feb 2019 09:31:13 +0100

tomcat9 (9.0.16-2) unstable; urgency=medium

  * Team upload.
  * tomcat9.service: Permit read and write access to /var/lib/solr too.
    (Closes: #919638)

 -- Markus Koschany <apo@debian.org>  Mon, 18 Feb 2019 20:58:51 +0100

tomcat9 (9.0.16-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Install the new Chinese, Czech, German, Korean and Portuguese translations
    - No longer build the extra WS and JMX jars
  * Standards-Version updated to 4.3.0

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 08 Feb 2019 08:26:48 +0100

tomcat9 (9.0.14-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Create the /var/log/tomcat9/ and /var/cache/tomcat9/ directories
    at install time (Closes: #915791)
  * Tightened the dependency on systemd

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 12 Dec 2018 13:45:52 +0100

tomcat9 (9.0.13-2) unstable; urgency=medium

  * Install the tomcat-embed-* artifacts with the 9.x version (Closes: #915578)
  * Modified the dependencies required for creating the tomcat user
    (adduser is replaced by systemd) (Closes: #915586)
  * Fixed the tomcat-jasper pom to reference the ECJ dependency
    from libeclipse-jdt-core-java
  * Removed the redundant ReadWritePaths options in the service file for the log
    and cache directories (Thanks to Lennart Poettering for the suggestion)

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 05 Dec 2018 10:04:52 +0100

# For older changelog entries, run 'apt-get changelog libtomcat9-embed-java'
