undertow (2.3.20-1ubuntu1) resolute; urgency=medium

  * SECURITY UPDATE: user session takeover issue
    - debian/patches/CVE-2025-12543-1.patch: Add handler to scrutinize Host
      header in request. Fix IP regex patterns to have proper range and
      include embedded adr
    - debian/patches/CVE-2025-12543-2.patch: Add checks for empty Host
      header
    - CVE-2025-12543

 -- Nishit Majithia <nishit.majithia@canonical.com>  Wed, 01 Apr 2026 12:12:27 +0530

undertow (2.3.20-1) unstable; urgency=medium

  * New upstream version 2.3.20.
    - Fix CVE-2025-9784: MadeYouReset DoS attack (Closes: #1117694)
  * Refresh the patches.
  * Let undertow migrate to testing again because the freeze is over.
    (Closes: #1103966)
  * Add HttpServletResponseImpl-sendRedirect.patch to fix a FTBFS.

 -- Markus Koschany <apo@debian.org>  Sun, 26 Oct 2025 20:56:44 +0100

undertow (2.3.18-2) unstable; urgency=medium

  * Team upload.
  * Depend on libtomcat11-java instead of libtomcat10-java
  * Standards-Version updated to 4.7.2

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 17 Mar 2025 00:21:25 +0100

undertow (2.3.18-1) unstable; urgency=medium

  * New upstream version 2.3.18
    - Fix CVE-2023-3223: (Closes: #1054893)
    - Fix CVE-2023-1973: (Closes: #1068815)
    - Fix CVE-2023-4639: (Closes: #1063539)
    - Fix CVE-2024-1459: (Closes: #1068816)
    - Fix CVE-2024-1635: (Closes: #1068817)
    - Fix CVE-2024-3653: (Closes: #1077547)
    - Fix CVE-2024-5971: (Closes: #1077545)
      Fix CVE-2024-7885: (Closes: #1082854)
  * Declare compliance with Debian Policy 4.7.0.

 -- Markus Koschany <apo@debian.org>  Fri, 03 Jan 2025 16:21:53 +0100

undertow (2.3.8-2) unstable; urgency=medium

  * Upload to unstable.

 -- Markus Koschany <apo@debian.org>  Mon, 21 Aug 2023 23:45:46 +0200

undertow (2.3.8-1) experimental; urgency=medium

  * New upstream version 2.3.8.
    - Fix CVE-2022-4492: (Closes: #1032087)
    - Fix CVE-2023-1108: (Closes: #1033253)
    - Builds from source again. (Closes: #1026695)
  * Declare compliance with Debian Policy 4.6.2.
  * Switch to Jakarta API.
  * Drop libundertow-java-doc package.

 -- Markus Koschany <apo@debian.org>  Sun, 20 Aug 2023 20:07:02 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog libundertow-java`.
