tomcat9 (9.0.16-3ubuntu0.18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: TLS Denial of Service
    - debian/patches/CVE-2021-41079.patch: Apache Tomcat did not properly
      validate incoming TLS packets. When Tomcat was configured to use
      NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be
      used to trigger an infinite loop resulting in a denial of service.
    - CVE-2021-41079
  * SECURITY UPDATE: Authentication Vulnerability
    - debian/patches/CVE-2021-30640.patch: A vulnerability in the JNDI Realm
      of Apache Tomcat allows an attacker to authenticate using variations of
      a validc user name and/or to bypass some of the protection provided by
      the LockOut Realm.
    - CVE-2021-30640
  * SECURITY UPDATE: Request Smuggling
    - debian/patches/CVE-2021-33037.patch: Apache Tomcat did not correctly
      parse the HTTP transfer-encoding request header in some circumstances
      leading to the possibility to request smuggling when used with a reverse
      proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding
      header if the client declared it would only accept an HTTP/1.0 response;
      - Tomcat honoured the identify encoding; and - Tomcat did not ensure
      that, if present, the chunked encoding was the final encoding.
    - CVE-2021-33037
  * SECURITY UPDATE: remote code execution via session persistence
    - debian/patches/CVE-2021-25329.patch: The fix for CVE-2020-9484 was
      incomplete. When using Apache Tomcat with a configuration edge case that
      was highly unlikely to be used, the Tomcat instance was still vulnerable
      to CVE-2020-9494. Note that both the previously published prerequisites
      for CVE-2020-9484 and the previously published mitigations for
      CVE-2020-9484 also apply to this issue.
    - CVE-2021-25329
  * SECURITY UPDATE: Request Header Duplication
    - debian/patches/CVE-2021-25122.patch: When responding to new h2c
      connection requests, Apache Tomcat could duplicate request headers and a
      limited amount of request body from one request to another meaning user
      A and user B could both see the results of user A's request.
    - CVE-2021-25122
  * SECURITY UPDATE: HTTP/2 request header mix-up
    - debian/patches/CVE-2020-17527.patch: HTTP/2 It was discovered that
      Apache Tomcat could re-use an HTTP request header value from the previous
      stream received on an HTTP/2 connection for the request associated with
      the subsequent stream. While this would most likely lead to an error and
      the closure of the HTTP/2 connection, it is possible that information
      could leak between requests.
    - CVE-2020-17527
  * SECURITY UPDATE: HTTP/2 request mix-up
    - debian/patches/CVE-2020-13943.patch: If an HTTP/2 client exceeded the
      agreed maximum number of concurrent streams for a connection (in
      violation of the HTTP/2 protocol), it was possible that a subsequent
      request made on that connection could contain HTTP headers - including
      HTTP/2 pseudo headers - from a previous request rather than the intended
      headers. This could lead to users seeing responses for unexpected
      resources.
    - CVE-2020-13943

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Tue, 29 Mar 2022 15:05:11 +0000

tomcat9 (9.0.16-3ubuntu0.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: XSS attack on SSI printenv command
    - debian/patches/CVE-2019-0221.patch: escape debug output to aid
      readability
    - CVE-2019-0221
  * SECURITY UPDATE: DoS via thread exhaustion
    - debian/patches/CVE-2019-10072-1.patch: expand HTTP/2 timeout
      handling to connection window exhaustion on write.
    - debian/patches/CVE-2019-10072-2.patch: Fix test failures. Handle
      full allocation case.
    - CVE-2019-10072

 -- Emilia Torino <emilia.torino@canonical.com>  Wed, 11 Sep 2019 16:47:51 -0300

tomcat9 (9.0.16-3~18.04.1) bionic; urgency=medium

  * Don't set nologin shell in sysusers.d/tomcat9.conf
    It is the default anyway and systemd-sysusers in 18.04 can't parse it.
    (LP: #1823125)

 -- Balint Reczey <rbalint@ubuntu.com>  Thu, 04 Apr 2019 13:49:17 +0200

tomcat9 (9.0.16-3~18.04) bionic; urgency=medium

  * Backport for OpenJDK 11. LP: #1817567.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 01 Mar 2019 14:06:51 +0100

tomcat9 (9.0.16-3) unstable; urgency=medium

  * Removed read/write access to /var/lib/solr (Closes: #923299)
  * Removed the broken catalina-ws.jar and catalina-jmx-remote.jar
    symlinks in /usr/share/tomcat9/lib/

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 26 Feb 2019 09:31:13 +0100

tomcat9 (9.0.16-2) unstable; urgency=medium

  * Team upload.
  * tomcat9.service: Permit read and write access to /var/lib/solr too.
    (Closes: #919638)

 -- Markus Koschany <apo@debian.org>  Mon, 18 Feb 2019 20:58:51 +0100

tomcat9 (9.0.16-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Install the new Chinese, Czech, German, Korean and Portuguese translations
    - No longer build the extra WS and JMX jars
  * Standards-Version updated to 4.3.0

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 08 Feb 2019 08:26:48 +0100

tomcat9 (9.0.14-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Create the /var/log/tomcat9/ and /var/cache/tomcat9/ directories
    at install time (Closes: #915791)
  * Tightened the dependency on systemd

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 12 Dec 2018 13:45:52 +0100

tomcat9 (9.0.13-2) unstable; urgency=medium

  * Install the tomcat-embed-* artifacts with the 9.x version (Closes: #915578)
  * Modified the dependencies required for creating the tomcat user
    (adduser is replaced by systemd) (Closes: #915586)
  * Fixed the tomcat-jasper pom to reference the ECJ dependency
    from libeclipse-jdt-core-java
  * Removed the redundant ReadWritePaths options in the service file for the log
    and cache directories (Thanks to Lennart Poettering for the suggestion)

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 05 Dec 2018 10:04:52 +0100

tomcat9 (9.0.13-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Renamed the package to tomcat9
    - Removed the libservlet3.1-java package. From now on the Servlet API
      is packaged in a separate package independent from Tomcat.
    - Depend on libeclipse-jdt-core-java (>= 3.14.0) instead of libecj-java
    - Updated the policy files in /etc/tomcat8/policy.d/
    - Use the OSGi metadata generated by the upstream build
    - Deploy the Tomcat artifacts in the Maven repository with the 9.x version
    - Updated the README file
  * Removed the SysV init script
  * Restart the server automatically on failures
  * Use a fixed non-configurable user 'tomcat' to run the server
  * Removed the debconf integration. The user being now unmodifiable,
    the remaining configuration parameter JAVA_OPTS can be edited in
    /etc/default/tomcat9
  * No longer add the 'common', 'server' and 'shared' directories under
    CATALINA_HOME and CATALINA_BASE to the classpath. Extra jar files should go
    to the 'lib' directory.
  * Let Tomcat handle the rotation of its log files with the maxDays parameter
    of the valves and log handlers instead of relying on a cron job
  * Renamed the TOMCAT_SECURITY parameter to SECURITY_MANAGER in the service
    configuration file
  * Simplified the postinst script by using systemd-sysusers to create
    the 'tomcat' user
  * No longer create the /etc/tomcat9/Catalina/localhost directory at install
    time and let Tomcat create it automatically
  * Let systemd automatically create /var/log/tomcat9 and /var/cache/tomcat9
  * Prevent Tomcat from writing outside of /var/log/tomcat9, /var/cache/tomcat9,
    /var/lib/tomcat9/webapps and /etc/tomcat9/Catalina by default. This can be
    overridden (see the README file).
  * Build and install the extra jar catalina-ws.jar
  * No longer recommend libcommons-pool-java and libcommons-dbcp-java since
    Tomcat already embeds its own version of these libraries
  * Support three-way merge when upgrading the configuration files
  * Use the G1 garbage collector by default instead of Concurrent Mark Sweep
  * The setenv.sh script in tomcat9-user and the service startup script now
    share the same JDK detection logic

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 28 Nov 2018 15:06:00 +0100

# For older changelog entries, run 'apt-get changelog libtomcat9-java'
