tomcat9 (9.0.95-1ubuntu1.1) questing-security; urgency=medium

  * SECURITY UPDATE: denial of service via unbounded WebDAV request body
    - debian/patches/CVE-2026-41284.patch: add BoundedByteArrayOutputStream
      to limit LOCK and PROPFIND request body size
    - CVE-2026-41284
  * SECURITY UPDATE: HTTP/2 header field validation bypass
    - debian/patches/CVE-2026-41293-pre.patch: add header validation
      infrastructure for HTTP/2 field names and values
    - debian/patches/CVE-2026-41293.patch: improve header field name and
      value validation in HpackDecoder and HPackHuffman
    - CVE-2026-41293
  * SECURITY UPDATE: exposure of HTTP auth header to unexpected hosts
    - debian/patches/CVE-2026-42498.patch: clear authentication headers
      after use and fix digest auth method handling
    - CVE-2026-42498
  * SECURITY UPDATE: authorization bypass via multiple method constraints
    - debian/patches/CVE-2026-43515.patch: check all matching
      SecurityCollection entries in RealmBase
    - CVE-2026-43515
  * SECURITY UPDATE: NullPointerException in digest authentication with
    invalid user
    - debian/patches/CVE-2026-43512.patch: add null check for password
      in RealmBase.getDigest()
    - CVE-2026-43512
  * SECURITY UPDATE: account lockout bypass via case-variant usernames
    - debian/patches/CVE-2026-43513.patch: normalize username case in
      LockOutRealm when caseSensitive is false
    - CVE-2026-43513

 -- Vyom Yadav <vyom.yadav@canonical.com>  Thu, 04 Jun 2026 16:56:12 +0530

tomcat9 (9.0.95-1ubuntu1) questing; urgency=medium

  * Merge with Debian unstable. (LP: #2116267) Remaning changes:
    - d/p/CVE-2025-24813.patch: Enhance lifecycle of
      temporary files used by partial PUT and use File.createTempFile()
      instead of custom naming based on resource path conversion in
      java/org/apache/catalina/servlets/DefaultServlet.java
  * Dropped changes, superseded upstream:
    - d/p/CVE-2023-46589_1.patch: Differentiate request cancellation
    - d/p/CVE-2023-46589_2.patch: Ensure IOException on request read
      always triggers error handling.
    - d/p/CVE-2023-28708.patch: Fix BZ 66471 - JSessionId
      secure attribute missing with RemoteIpFilter and X-Forwarded-Proto
      set to https
    - d/p/CVE-2023-42795.patch: Improve handling of failures during
      recycle() methods
    - d/p/CVE-2023-45648.patch: Align processing of trailer headers with
      standard processing
    - d/p/CVE-2024-23672-pre-1.patch: Rename prior to extending with
      additional tests
    - d/p/CVE-2024-23672-pre-2.patch: Add test util getter for root
      context with class path scanning disabled
    - d/p/CVE-2024-23672.patch: Refactor WebSocket close for suspend/resume
    - d/p/CVE-2024-24549.patch: Report HTTP/2 header parsing
      errors earlier
    - d/p/CVE-2024-24549-post-1.patch: Make recycled streams eligible for
      GC immediately. Improves scalability.
    - d/p/CVE-2024-24549-post-2.patch: Update tests after HTTP/2
      improvements
    - d/p/CVE-2024-34750-pre-1.patch: Fix 66530 - Regression in fix for
      BZ 66442. Ensure count is decremented
    - d/p/CVE-2024-34750-pre-2.patch: Refactor decrement using a common
      method
    - d/p/CVE-2024-34750.patch: Make counting of active streams more robust
    - d/p/CVE-2024-38286.patch: Add support for re-keying with TLS 1.3
    - Search for the appropriate JDT jar according to new project
      structure. This is was fixed in debian unstable in
      d/p/0030-eclipse-jdt-classpath.patch

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Wed, 09 Jul 2025 17:12:14 +0200

tomcat9 (9.0.95-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Add the missing dependency on libeclipse-jdt-core-compiler-batch-java
    (Closes: #1078389)
  * No longer suggest the removed tomcat9 package
  * Standards-Version updated to 4.7.0

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 30 Sep 2024 14:22:45 +0200

tomcat9 (9.0.70-2ubuntu3) questing; urgency=medium

  * SECURITY UPDATE: Information disclosure via missing secure attribute
    - debian/patches/CVE-2023-28708.patch: Fix BZ 66471 - JSessionId
      secure attribute missing with RemoteIpFilter and X-Forwarded-Proto
      set to https
    - CVE-2023-28708
  * SECURITY UPDATE: Information disclosure via incomplete cleanup
    - debian/patches/CVE-2023-42795.patch: Improve handling of failures
      during recycle() methods
    - CVE-2023-42795
  * SECURITY UPDATE: HTTP request smuggling via trailer headers
    - debian/patches/CVE-2023-45648.patch: Align processing of trailer
      headers with standard processing
    - CVE-2023-45648
  * SECURITY UPDATE: Denial of service via WebSocket connections
    - debian/patches/CVE-2024-23672-pre-1.patch: Rename prior to
      extending with additional tests
    - debian/patches/CVE-2024-23672-pre-2.patch: Add test util getter
      for root context with class path scanning disabled
    - debian/patches/CVE-2024-23672.patch: Refactor WebSocket close for
      suspend/resume
    - CVE-2024-23672
  * SECURITY UPDATE: Denial of service via HTTP/2 header parsing
    - debian/patches/CVE-2024-24549.patch: Report HTTP/2 header parsing
      errors earlier
    - debian/patches/CVE-2024-24549-post-1.patch: Make recycled streams
      eligible for GC immediately. Improves scalability.
    - debian/patches/CVE-2024-24549-post-2.patch: Update tests after
      HTTP/2 improvements
    - CVE-2024-24549
  * SECURITY UPDATE: Denial of service via HTTP/2 stream handling
    - debian/patches/CVE-2024-34750-pre-1.patch: Fix 66530 - Regression
      in fix for BZ 66442. Ensure count is decremented
    - debian/patches/CVE-2024-34750-pre-2.patch: Refactor decrement
      using a common method
    - debian/patches/CVE-2024-34750.patch: Make counting of active
      streams more robust
    - CVE-2024-34750
  * SECURITY UPDATE: Denial of service via TLS handshake abuse
    - debian/patches/CVE-2024-38286.patch: Add support for re-keying
      with TLS 1.3
    - CVE-2024-38286 

 -- Vyom Yadav <vyom.yadav@canonical.com>  Mon, 09 Jun 2025 16:07:45 +0530

tomcat9 (9.0.70-2ubuntu2) questing; urgency=medium

  * SECURITY UPDATE: Path equivalence vulnerability in DefaultServlet
    - debian/patches/CVE-2025-24813.patch: Enhance lifecycle of
      temporary files used by partial PUT and use File.createTempFile()
      instead of custom naming based on resource path conversion in
      java/org/apache/catalina/servlets/DefaultServlet.java
    - CVE-2025-24813

 -- Vyom Yadav <vyom.yadav@canonical.com>  Mon, 26 May 2025 12:58:55 +0530

tomcat9 (9.0.70-2ubuntu1.1) oracular; urgency=medium

  * Search for the appropriate JDT jar according to new project structure

 -- Octavio Galland <octavio.galland@canonical.com>  Tue, 24 Sep 2024 15:59:05 -0300

tomcat9 (9.0.70-2ubuntu1) oracular; urgency=medium

  * SECURITY UPDATE: HTTP request smuggling via invalid header size
    - debian/patches/CVE-2023-46589_1.patch: Differentiate request cancellation
      from a bad request.
    - debian/patches/CVE-2023-46589_2.patch: Ensure IOException on request read
      always triggers error handling.
    - CVE-2023-46589

 -- Octavio Galland <octavio.galland@canonical.com>  Mon, 23 Sep 2024 14:01:33 -0300

tomcat9 (9.0.70-2) unstable; urgency=medium

  * Team upload.
  * Drop tomcat9 server packages because only one Tomcat version is supported
    per release. Only retain libtomcat9-java because of compatibility reasons
    for now. Users are strongly encouraged to switch to Tomcat 10 instead.
    (Closes: #1034824)

 -- Markus Koschany <apo@debian.org>  Sat, 27 May 2023 17:51:32 +0200

tomcat9 (9.0.70-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 05 Dec 2022 18:50:40 +0100

tomcat9 (9.0.68-1) unstable; urgency=medium

  * New upstream release
  * Look for OpenJDK 17 and up to 21 when starting the server (Closes: #1020948)
  * Simplified the Maven rules

 -- Emmanuel Bourg <ebourg@apache.org>  Sat, 08 Oct 2022 13:53:36 +0200

tomcat9 (9.0.67-1) unstable; urgency=medium

  * Team upload.

  [ Thorsten Glaser ]
  * Fix a Policy violation in the Depends of bin:tomcat9

  [ Emmanuel Bourg ]
  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 27 Sep 2022 00:49:00 +0200

tomcat9 (9.0.65-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.65.

 -- Markus Koschany <apo@debian.org>  Fri, 12 Aug 2022 12:56:06 +0200

tomcat9 (9.0.64-2) unstable; urgency=medium

  * Fallback to the default log formatter when systemd isn't used
  * Depend on systemd-sysusers and systemd-tmpfiles instead of systemd
  * Depend on libeclipse-jdt-core-java (>= 3.26.0)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 21 Jun 2022 14:59:03 +0200

tomcat9 (9.0.64-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.6.1

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 20 Jun 2022 15:17:59 +0200

tomcat9 (9.0.63-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.63.
    - Fix CVE-2022-29885: Improve documentation for the EncryptInterceptor and
      do not claim it protects against all risks associated with running over
      any untrusted network.

 -- Markus Koschany <apo@debian.org>  Fri, 13 May 2022 14:04:35 +0200

tomcat9 (9.0.62-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.62.
  * Drop 0027-java11-compilation.patch because it is apparently no longer
    required.
  * Refresh disable-jacoco.patch for new release.
  * Depend on java11-runtime-headless because Java 8 is no longer supported.
    Thanks to Per Lundberg for the report. (Closes: #1006647)

 -- Markus Koschany <apo@debian.org>  Fri, 29 Apr 2022 23:10:59 +0200

tomcat9 (9.0.58-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.58.
  * Add disable-jacoco.patch and remove the dependency on jacoco when running
    the test suite.

 -- Markus Koschany <apo@debian.org>  Wed, 09 Feb 2022 15:51:20 +0100

tomcat9 (9.0.55-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.55.

 -- Markus Koschany <apo@debian.org>  Mon, 15 Nov 2021 22:12:42 +0100

tomcat9 (9.0.54-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.54.
    - Fix CVE-2021-42340:
      The fix for bug 63362 introduced a memory leak. The object introduced to
      collect metrics for HTTP upgrade connections was not released for
      WebSocket connections once the connection was closed. This created a
      memory leak that, over time, could lead to a denial of service via an
      OutOfMemoryError.
  * Update 0010-debianize-build-xml.patch and depend on the setup-bnd task to
    prevent a FTBFS when building the tests. This replaces the workaround by
    setting addOSGi to false.
    Thanks to Aurimas Fišeras for the report.

 -- Markus Koschany <apo@debian.org>  Fri, 22 Oct 2021 21:59:08 +0200

tomcat9 (9.0.53-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.53.
    - Drop security patches. Fixed upstream.
    - Fix CVE-2021-41079:
      Apache Tomcat did not properly validate incoming TLS packets. When Tomcat
      was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially
      crafted packet could be used to trigger an infinite loop resulting in a
      denial of service.
  * Declare compliance with Debian Policy 4.6.0.
  * Set the fileOwner of catalina.out to tomcat explicitly.
    Thanks to Adam Cecile for the report. (Closes: #987179)
  * Refresh 0021-dont-test-unsupported-ciphers.patch
  * tomcat9.cron.daily: Set maxdepth to 1 so that log files of custom
    applications in subdirectories of /var/log/tomcat9 are not compressed.
    Thanks to Ludovic Pouzenc for the report. (Closes: #982961)
  * Exclude TestJNDIRealmIntegration because of missing dependencies.

 -- Markus Koschany <apo@debian.org>  Fri, 24 Sep 2021 15:37:51 +0200

tomcat9 (9.0.43-3) unstable; urgency=medium

  * Team upload.
  * CVE-2021-30640: Fix NullPointerException.
    If no userRoleAttribute is specified in the user's Realm configuration its
    default value will be null. This will cause a NPE in the methods
    doFilterEscaping and doAttributeValueEscaping. This is upstream bug
    https://bz.apache.org/bugzilla/show_bug.cgi?id=65308

 -- Markus Koschany <apo@debian.org>  Tue, 10 Aug 2021 17:17:56 +0200

tomcat9 (9.0.43-2) unstable; urgency=medium

  * Team upload.

  [ mirabilos ]
  * fix /var/log/tomcat9 permissions
    fixup for commit 51128fe9fb2d4d0b56be675d845cf92e4301a6c3

  [ Markus Koschany ]
  * Fix CVE-2021-30640:
    A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to
    authenticate using variations of a valid user name and/or to bypass some of
    the protection provided by the LockOut Realm.
  * Fix CVE-2021-33037:
    Apache Tomcat did not correctly parse the HTTP transfer-encoding request
    header in some circumstances leading to the possibility to request
    smuggling when used with a reverse proxy. Specifically: - Tomcat
    incorrectly ignored the transfer encoding header if the client declared it
    would only accept an HTTP/1.0 response; - Tomcat honoured the identify
    encoding; and - Tomcat did not ensure that, if present, the chunked
    encoding was the final encoding.
    (Closes: #991046)

 -- Markus Koschany <apo@debian.org>  Sat, 07 Aug 2021 00:11:43 +0200

tomcat9 (9.0.43-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Rotate the catalina.out log file with the tomcat user (Closes: #971583)
  * Switch to debhelper level 13

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 02 Feb 2021 20:23:51 +0100

tomcat9 (9.0.41-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.5.1

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 09 Dec 2020 16:03:00 +0100

tomcat9 (9.0.40-1) unstable; urgency=medium

  [ Emmanuel Bourg ]
  * New upstream release
    - Refreshed the patches
  * Changed the home directory of the tomcat user to /var/lib/tomcat
    (Closes: #926338)

  [ Vincent McIntyre ]
  * Automatically export the JAVA_HOME environment variable when the value
    is defined in /etc/defaults/tomcat9 (Closes: #966338)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 24 Nov 2020 08:21:29 +0100

tomcat9 (9.0.39-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * tomcat9-user now depends on netcat-openbsd instead of netcat
    (Closes: #966158)

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 12 Oct 2020 17:16:57 +0200

tomcat9 (9.0.38-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 16 Sep 2020 16:04:03 +0200

tomcat9 (9.0.37-3) unstable; urgency=medium

  * control: Bump build-dep on bnd, drop bnd compat and re-export patches.
    (Closes: #964433)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 06 Aug 2020 18:59:11 +0300

tomcat9 (9.0.37-2) unstable; urgency=medium

  * d/p/0029-fix-regression-in-bz64540.patch: Re-export util.net.jsse
    and util.modeler.modules. (Closes: #964433)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 28 Jul 2020 14:09:13 +0300

tomcat9 (9.0.37-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Fixed the compatibility with the version of bnd in Debian
  * Restored execute permission on /var/log/tomcat9 to the adm group

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 06 Jul 2020 22:39:32 +0200

tomcat9 (9.0.36-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Grant write access on /var/log/tomcat9 to the adm group (LP: #1861881)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 23 Jun 2020 11:47:47 +0200

tomcat9 (9.0.35-1) unstable; urgency=medium

  * New upstream release
    - Fixes CVE-2020-9484: Remote Code Execution via session persistence (Closes: #961209)
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 21 May 2020 15:50:03 +0200

tomcat9 (9.0.34-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Depend on libeclipse-jdt-core-java (>= 3.18.0)
  * Switch to debhelper level 12

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 27 Apr 2020 00:36:59 +0200

tomcat9 (9.0.31-1) unstable; urgency=medium

  * New upstream release
    - Fixes CVE-2019-10072: Denial of Service (Closes: #930872)
    - Fixes CVE-2019-12418: Local Privilege Escalation
    - Fixes CVE-2019-17563: Session fixation attack
    - Fixes CVE-2019-17569: HTTP Request Smuggling
    - Fixes CVE-2020-1935: HTTP Request Smuggling
    - Fixes CVE-2020-1938: AJP Request Injection (Closes: #952437)
    - Fixes CATALINA_PID handling in catalina.sh (Closes: #948553)
    - Refreshed the patches
    - Fixed the compilation with Java 11
  * Moved the RequiresMountsFor directive in the service file
    to the Unit section (Closes: #942316)
  * Tightened the dependency on systemd (Closes: #931997)
  * Standards-Version updated to 4.5.0

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 24 Feb 2020 23:37:00 +0100

tomcat9 (9.0.27-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.4.1

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 14 Oct 2019 11:31:50 +0200

tomcat9 (9.0.24-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 22 Aug 2019 13:55:14 +0200

tomcat9 (9.0.22-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Track and download the new releases from GitHub
  * Standards-Version updated to 4.4.0

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 12 Jul 2019 15:01:28 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libtomcat9-java`.
