tomcat9 (9.0.118-1~24.04.1) noble; urgency=medium

  * Backport to Noble (LP: #2155817):
    - debian/control: Relaxed eclipse JDT core compiler requirement.

 -- Reuben Roessler <reuben.roessler@canonical.com>  Mon, 08 Jun 2026 14:42:16 +1000

tomcat9 (9.0.118-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - New build dependency on Bouncy Castle
  * Removed the build dependency on libtcnative-1
  * Standards-Version updated to 4.7.4

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 27 May 2026 11:38:17 +0200

tomcat9 (9.0.115-1) unstable; urgency=medium

  * Team upload
  * New upstream version
  * Fix SSL socket factory configuration in the JNDI realm.
  * Fix a memory leak when using a trust store with the OpenSSL provider.
  * Add strictSni attribute on the Connector to allow matching the
    SSLHostConfig configuration associated with the SNI host name
    to the SSLHostConfig configuration matched from the HTTP protocol
    host name.
    Non matching configurations will cause the request to be
    rejected. The attribute default value is true,
    enabling the matching.
  * Correct a regression introduced in 9.0.109 that broke
    some clustering configurations.
  * Update Commons Daemon to 1.5.0.
  * For configuration consistency between OpenSSL and JSSE TLS
    implementations, TLSv1.3 cipher suites included in the
    ciphers attribute of an SSLHostConfig are now always
    ignored (previously they would be ignored with OpenSSL
    implementations and used with JSSE implementations) and
    a warning is logged that the cipher suite has been ignored.
  * Expand OCSP support to JSSE based connections and
    expand OCSP configuration options.
  * Update Commons Daemon to 1.5.1.
  * Update Tomcat Native to 2.0.12 and increase the
    minimum version to 2.0.12 / 1.3.4.

 -- Bastien Roucariès <rouca@debian.org>  Sun, 01 Feb 2026 15:37:07 +0100

tomcat9 (9.0.111-1) unstable; urgency=medium

  * Team upload
  * New upstream release

 -- Bastien Roucariès <rouca@debian.org>  Sat, 25 Oct 2025 16:51:01 +0200

tomcat9 (9.0.95-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Add the missing dependency on libeclipse-jdt-core-compiler-batch-java
    (Closes: #1078389)
  * No longer suggest the removed tomcat9 package
  * Standards-Version updated to 4.7.0

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 30 Sep 2024 14:22:45 +0200

tomcat9 (9.0.70-2) unstable; urgency=medium

  * Team upload.
  * Drop tomcat9 server packages because only one Tomcat version is supported
    per release. Only retain libtomcat9-java because of compatibility reasons
    for now. Users are strongly encouraged to switch to Tomcat 10 instead.
    (Closes: #1034824)

 -- Markus Koschany <apo@debian.org>  Sat, 27 May 2023 17:51:32 +0200

tomcat9 (9.0.70-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 05 Dec 2022 18:50:40 +0100

tomcat9 (9.0.68-1) unstable; urgency=medium

  * New upstream release
  * Look for OpenJDK 17 and up to 21 when starting the server (Closes: #1020948)
  * Simplified the Maven rules

 -- Emmanuel Bourg <ebourg@apache.org>  Sat, 08 Oct 2022 13:53:36 +0200

tomcat9 (9.0.67-1) unstable; urgency=medium

  * Team upload.

  [ Thorsten Glaser ]
  * Fix a Policy violation in the Depends of bin:tomcat9

  [ Emmanuel Bourg ]
  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 27 Sep 2022 00:49:00 +0200

tomcat9 (9.0.65-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.65.

 -- Markus Koschany <apo@debian.org>  Fri, 12 Aug 2022 12:56:06 +0200

tomcat9 (9.0.64-2) unstable; urgency=medium

  * Fallback to the default log formatter when systemd isn't used
  * Depend on systemd-sysusers and systemd-tmpfiles instead of systemd
  * Depend on libeclipse-jdt-core-java (>= 3.26.0)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 21 Jun 2022 14:59:03 +0200

tomcat9 (9.0.64-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.6.1

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 20 Jun 2022 15:17:59 +0200

tomcat9 (9.0.63-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.63.
    - Fix CVE-2022-29885: Improve documentation for the EncryptInterceptor and
      do not claim it protects against all risks associated with running over
      any untrusted network.

 -- Markus Koschany <apo@debian.org>  Fri, 13 May 2022 14:04:35 +0200

tomcat9 (9.0.62-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.62.
  * Drop 0027-java11-compilation.patch because it is apparently no longer
    required.
  * Refresh disable-jacoco.patch for new release.
  * Depend on java11-runtime-headless because Java 8 is no longer supported.
    Thanks to Per Lundberg for the report. (Closes: #1006647)

 -- Markus Koschany <apo@debian.org>  Fri, 29 Apr 2022 23:10:59 +0200

tomcat9 (9.0.58-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.58.
  * Add disable-jacoco.patch and remove the dependency on jacoco when running
    the test suite.

 -- Markus Koschany <apo@debian.org>  Wed, 09 Feb 2022 15:51:20 +0100

tomcat9 (9.0.55-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.55.

 -- Markus Koschany <apo@debian.org>  Mon, 15 Nov 2021 22:12:42 +0100

tomcat9 (9.0.54-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.54.
    - Fix CVE-2021-42340:
      The fix for bug 63362 introduced a memory leak. The object introduced to
      collect metrics for HTTP upgrade connections was not released for
      WebSocket connections once the connection was closed. This created a
      memory leak that, over time, could lead to a denial of service via an
      OutOfMemoryError.
  * Update 0010-debianize-build-xml.patch and depend on the setup-bnd task to
    prevent a FTBFS when building the tests. This replaces the workaround by
    setting addOSGi to false.
    Thanks to Aurimas Fišeras for the report.

 -- Markus Koschany <apo@debian.org>  Fri, 22 Oct 2021 21:59:08 +0200

tomcat9 (9.0.53-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.53.
    - Drop security patches. Fixed upstream.
    - Fix CVE-2021-41079:
      Apache Tomcat did not properly validate incoming TLS packets. When Tomcat
      was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially
      crafted packet could be used to trigger an infinite loop resulting in a
      denial of service.
  * Declare compliance with Debian Policy 4.6.0.
  * Set the fileOwner of catalina.out to tomcat explicitly.
    Thanks to Adam Cecile for the report. (Closes: #987179)
  * Refresh 0021-dont-test-unsupported-ciphers.patch
  * tomcat9.cron.daily: Set maxdepth to 1 so that log files of custom
    applications in subdirectories of /var/log/tomcat9 are not compressed.
    Thanks to Ludovic Pouzenc for the report. (Closes: #982961)
  * Exclude TestJNDIRealmIntegration because of missing dependencies.

 -- Markus Koschany <apo@debian.org>  Fri, 24 Sep 2021 15:37:51 +0200

tomcat9 (9.0.43-3) unstable; urgency=medium

  * Team upload.
  * CVE-2021-30640: Fix NullPointerException.
    If no userRoleAttribute is specified in the user's Realm configuration its
    default value will be null. This will cause a NPE in the methods
    doFilterEscaping and doAttributeValueEscaping. This is upstream bug
    https://bz.apache.org/bugzilla/show_bug.cgi?id=65308

 -- Markus Koschany <apo@debian.org>  Tue, 10 Aug 2021 17:17:56 +0200

tomcat9 (9.0.43-2) unstable; urgency=medium

  * Team upload.

  [ mirabilos ]
  * fix /var/log/tomcat9 permissions
    fixup for commit 51128fe9fb2d4d0b56be675d845cf92e4301a6c3

  [ Markus Koschany ]
  * Fix CVE-2021-30640:
    A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to
    authenticate using variations of a valid user name and/or to bypass some of
    the protection provided by the LockOut Realm.
  * Fix CVE-2021-33037:
    Apache Tomcat did not correctly parse the HTTP transfer-encoding request
    header in some circumstances leading to the possibility to request
    smuggling when used with a reverse proxy. Specifically: - Tomcat
    incorrectly ignored the transfer encoding header if the client declared it
    would only accept an HTTP/1.0 response; - Tomcat honoured the identify
    encoding; and - Tomcat did not ensure that, if present, the chunked
    encoding was the final encoding.
    (Closes: #991046)

 -- Markus Koschany <apo@debian.org>  Sat, 07 Aug 2021 00:11:43 +0200

tomcat9 (9.0.43-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Rotate the catalina.out log file with the tomcat user (Closes: #971583)
  * Switch to debhelper level 13

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 02 Feb 2021 20:23:51 +0100

tomcat9 (9.0.41-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.5.1

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 09 Dec 2020 16:03:00 +0100

tomcat9 (9.0.40-1) unstable; urgency=medium

  [ Emmanuel Bourg ]
  * New upstream release
    - Refreshed the patches
  * Changed the home directory of the tomcat user to /var/lib/tomcat
    (Closes: #926338)

  [ Vincent McIntyre ]
  * Automatically export the JAVA_HOME environment variable when the value
    is defined in /etc/defaults/tomcat9 (Closes: #966338)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 24 Nov 2020 08:21:29 +0100

tomcat9 (9.0.39-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * tomcat9-user now depends on netcat-openbsd instead of netcat
    (Closes: #966158)

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 12 Oct 2020 17:16:57 +0200

tomcat9 (9.0.38-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 16 Sep 2020 16:04:03 +0200

tomcat9 (9.0.37-3) unstable; urgency=medium

  * control: Bump build-dep on bnd, drop bnd compat and re-export patches.
    (Closes: #964433)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 06 Aug 2020 18:59:11 +0300

tomcat9 (9.0.37-2) unstable; urgency=medium

  * d/p/0029-fix-regression-in-bz64540.patch: Re-export util.net.jsse
    and util.modeler.modules. (Closes: #964433)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 28 Jul 2020 14:09:13 +0300

tomcat9 (9.0.37-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Fixed the compatibility with the version of bnd in Debian
  * Restored execute permission on /var/log/tomcat9 to the adm group

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 06 Jul 2020 22:39:32 +0200

tomcat9 (9.0.36-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Grant write access on /var/log/tomcat9 to the adm group (LP: #1861881)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 23 Jun 2020 11:47:47 +0200

tomcat9 (9.0.35-1) unstable; urgency=medium

  * New upstream release
    - Fixes CVE-2020-9484: Remote Code Execution via session persistence (Closes: #961209)
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 21 May 2020 15:50:03 +0200

tomcat9 (9.0.34-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Depend on libeclipse-jdt-core-java (>= 3.18.0)
  * Switch to debhelper level 12

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 27 Apr 2020 00:36:59 +0200

tomcat9 (9.0.31-1) unstable; urgency=medium

  * New upstream release
    - Fixes CVE-2019-10072: Denial of Service (Closes: #930872)
    - Fixes CVE-2019-12418: Local Privilege Escalation
    - Fixes CVE-2019-17563: Session fixation attack
    - Fixes CVE-2019-17569: HTTP Request Smuggling
    - Fixes CVE-2020-1935: HTTP Request Smuggling
    - Fixes CVE-2020-1938: AJP Request Injection (Closes: #952437)
    - Fixes CATALINA_PID handling in catalina.sh (Closes: #948553)
    - Refreshed the patches
    - Fixed the compilation with Java 11
  * Moved the RequiresMountsFor directive in the service file
    to the Unit section (Closes: #942316)
  * Tightened the dependency on systemd (Closes: #931997)
  * Standards-Version updated to 4.5.0

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 24 Feb 2020 23:37:00 +0100

tomcat9 (9.0.27-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.4.1

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 14 Oct 2019 11:31:50 +0200

tomcat9 (9.0.24-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 22 Aug 2019 13:55:14 +0200

tomcat9 (9.0.22-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Track and download the new releases from GitHub
  * Standards-Version updated to 4.4.0

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 12 Jul 2019 15:01:28 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libtomcat9-java`.
