tomcat10 (10.1.34-0+deb12u2) bookworm-security; urgency=high

  * Team upload.
  * Fix CVE-2025-24813:
    It was found that a malicious user was able to view security sensitive
    files and/or inject content into those files when writes were enabled for
    the default servlet (disabled by default) and support for partial PUT was
    enabled (default). Under certain circumstances, depending on the
    application in use, remote code execution may have been possible.

 -- Markus Koschany <apo@debian.org>  Wed, 01 Apr 2025 23:03:17 +0200

tomcat10 (10.1.34-0+deb12u1) bookworm-security; urgency=high

  * Team upload.
  * Backport 10.1.34 to bookworm to fix open CVE and improve HTTP/2
    functionality.
  * Fix CVE-2024-52316:
    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is
    configured to use a custom Jakarta Authentication (formerly JASPIC)
    ServerAuthContext component which may throw an exception during the
    authentication process without explicitly setting an HTTP status to
    indicate failure, the authentication may not fail, allowing the user to
    bypass the authentication process. There are no known Jakarta
    Authentication components that behave in this way.
  * Fix CVE-2024-38286:
    Apache Tomcat, under certain configurations, allows an attacker to cause an
    OutOfMemoryError by abusing the TLS handshake process.
  * Fix CVE-2024-50379 / CVE-2024-56337:
    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP
    compilation in Apache Tomcat permits an RCE on case insensitive file
    systems when the default servlet is enabled for write (non-default
    configuration).
    Some users may need additional configuration to fully mitigate
    CVE-2024-50379 depending on which version of Java they are using with
    Tomcat. For Debian 12 "bookworm" the system property sun.io.useCanonCaches
    must be explicitly set to false (it defaults to false). Most Debian users
    will not be affected because Debian uses case sensitive file systems by
    default.
  * Fix CVE-2024-34750:
    Improper Handling of Exceptional Conditions, Uncontrolled Resource
    Consumption vulnerability in Apache Tomcat. When processing an HTTP/2
    stream, Tomcat did not handle some cases of excessive HTTP headers
    correctly. This led to a miscounting of active HTTP/2 streams which in turn
    led to the use of an incorrect infinite timeout which allowed connections
    to remain open which should have been closed.
  * Fix CVE-2024-54677:
    Uncontrolled Resource Consumption vulnerability in the examples web
    application provided with Apache Tomcat leads to denial of service.

 -- Markus Koschany <apo@debian.org>  Thu, 16 Jan 2025 22:40:13 +0100

tomcat10 (10.1.6-1+deb12u2) bookworm-security; urgency=high

  * Team upload.
  * Fix CVE-2023-46589:
    Improper Input Validation vulnerability in Apache Tomcat. Tomcat 10 did not
    correctly parse HTTP trailer headers. A trailer header that exceeded the
    header size limit could cause Tomcat to treat a single request as multiple
    requests leading to the possibility of request smuggling when behind a
    reverse proxy.
  * Fix CVE-2024-24549:
    Denial of Service due to improper input validation vulnerability for
    HTTP/2. When processing an HTTP/2 request, if the request exceeded any of
    the configured limits for headers, the associated HTTP/2 stream was not
    reset until after all of the headers had been processed.
  * Fix CVE-2024-23672:
    Denial of Service via incomplete cleanup vulnerability. It was possible for
    WebSocket clients to keep WebSocket connections open leading to increased
    resource consumption.

 -- Markus Koschany <apo@debian.org>  Mon, 15 Apr 2024 22:05:02 +0200

tomcat10 (10.1.6-1+deb12u1) bookworm-security; urgency=high

  * Fix CVE-2023-45648: Request smuggling. Tomcat did not correctly parse HTTP
    trailer headers. A specially crafted, invalid trailer header could cause
    Tomcat to treat a single request as multiple requests leading to the
    possibility of request smuggling when behind a reverse proxy.
  * Fix CVE-2023-44487: DoS caused by HTTP/2 frame overhead (Rapid Reset Attack)
  * Fix CVE-2023-42795: Information Disclosure. When recycling various internal
    objects, including the request and the response, prior to re-use by the next
    request/response, an error could cause Tomcat to skip some parts of the
    recycling process leading to information leaking from the current
    request/response to the next.
  * Fix CVE-2023-41080: Open redirect. If the ROOT (default) web application
    is configured to use FORM authentication then it is possible that a
    specially crafted URL could be used to trigger a redirect to an URL of
    the attackers choice.
  * Fix CVE-2023-28709: Denial of Service. If non-default HTTP connector
    settings were used such that the maxParameterCount could be reached using
    query string parameters and a request was submitted that supplied exactly
    maxParameterCount parameters in the query string, the limit for uploaded
    request parts could be bypassed with the potential for a denial of service
    to occur.

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 10 Oct 2023 18:33:08 +0200

tomcat10 (10.1.6-1) unstable; urgency=medium

  * New upstream version 10.1.6
  * Tighten dependency on libtcnative-1.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Thu, 23 Feb 2023 12:49:47 +0100

tomcat10 (10.1.5-2) unstable; urgency=medium

  * Install and link to websocket-client-api.jar. Fixes ClassNotFoundException.
    Thanks to Jorge Moraleda for the report. (Closes: #1030869)

 -- Markus Koschany <apo@debian.org>  Sun, 12 Feb 2023 19:27:47 +0100

tomcat10 (10.1.5-1) unstable; urgency=medium

  * New upstream version.
  * Drop tomcat-jakartaee-migration.patch. Fixed upstream.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Wed, 01 Feb 2023 00:13:09 +0100

tomcat10 (10.0.27-1) unstable; urgency=medium

  * New upstream version.
  * Release to unstable.
  * Make tomcat9 and tomcat10 co-installable. (Closes: #965006)
  * Tomcat 10 can be built from source again. (Closes: #1028632)
  * Add myself to Uploaders.
  * Declare compliance with Debian Policy 4.6.2.

 -- Markus Koschany <apo@debian.org>  Mon, 16 Jan 2023 22:51:22 +0100

tomcat10 (10.0.0~M7-1) experimental; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Fixed the compatibility with the version of bnd in Debian
  * Set the generic version of the Maven artifacts to 10.x (Fixes: #965006)
  * Grant write access on /var/log/tomcat10 to the adm group

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 14 Jul 2020 20:14:44 +0200

tomcat10 (10.0.0~M6-1) experimental; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Renamed the package to tomcat10
    - Migrate the taglibs-standard libraries to the Jakarta EE namespace

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 15 Jun 2020 09:51:05 +0200

tomcat9 (9.0.70-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 05 Dec 2022 18:50:40 +0100

tomcat9 (9.0.68-1) unstable; urgency=medium

  * New upstream release
  * Look for OpenJDK 17 and up to 21 when starting the server (Closes: #1020948)
  * Simplified the Maven rules

 -- Emmanuel Bourg <ebourg@apache.org>  Sat, 08 Oct 2022 13:53:36 +0200

tomcat9 (9.0.67-1) unstable; urgency=medium

  * Team upload.

  [ Thorsten Glaser ]
  * Fix a Policy violation in the Depends of bin:tomcat9

  [ Emmanuel Bourg ]
  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 27 Sep 2022 00:49:00 +0200

tomcat9 (9.0.65-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.65.

 -- Markus Koschany <apo@debian.org>  Fri, 12 Aug 2022 12:56:06 +0200

tomcat9 (9.0.64-2) unstable; urgency=medium

  * Fallback to the default log formatter when systemd isn't used
  * Depend on systemd-sysusers and systemd-tmpfiles instead of systemd
  * Depend on libeclipse-jdt-core-java (>= 3.26.0)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 21 Jun 2022 14:59:03 +0200

tomcat9 (9.0.64-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.6.1

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 20 Jun 2022 15:17:59 +0200

tomcat9 (9.0.63-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.63.
    - Fix CVE-2022-29885: Improve documentation for the EncryptInterceptor and
      do not claim it protects against all risks associated with running over
      any untrusted network.

 -- Markus Koschany <apo@debian.org>  Fri, 13 May 2022 14:04:35 +0200

tomcat9 (9.0.62-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.62.
  * Drop 0027-java11-compilation.patch because it is apparently no longer
    required.
  * Refresh disable-jacoco.patch for new release.
  * Depend on java11-runtime-headless because Java 8 is no longer supported.
    Thanks to Per Lundberg for the report. (Closes: #1006647)

 -- Markus Koschany <apo@debian.org>  Fri, 29 Apr 2022 23:10:59 +0200

tomcat9 (9.0.58-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.58.
  * Add disable-jacoco.patch and remove the dependency on jacoco when running
    the test suite.

 -- Markus Koschany <apo@debian.org>  Wed, 09 Feb 2022 15:51:20 +0100

tomcat9 (9.0.55-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.55.

 -- Markus Koschany <apo@debian.org>  Mon, 15 Nov 2021 22:12:42 +0100

tomcat9 (9.0.54-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.54.
    - Fix CVE-2021-42340:
      The fix for bug 63362 introduced a memory leak. The object introduced to
      collect metrics for HTTP upgrade connections was not released for
      WebSocket connections once the connection was closed. This created a
      memory leak that, over time, could lead to a denial of service via an
      OutOfMemoryError.
  * Update 0010-debianize-build-xml.patch and depend on the setup-bnd task to
    prevent a FTBFS when building the tests. This replaces the workaround by
    setting addOSGi to false.
    Thanks to Aurimas Fišeras for the report.

 -- Markus Koschany <apo@debian.org>  Fri, 22 Oct 2021 21:59:08 +0200

tomcat9 (9.0.53-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.0.53.
    - Drop security patches. Fixed upstream.
    - Fix CVE-2021-41079:
      Apache Tomcat did not properly validate incoming TLS packets. When Tomcat
      was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially
      crafted packet could be used to trigger an infinite loop resulting in a
      denial of service.
  * Declare compliance with Debian Policy 4.6.0.
  * Set the fileOwner of catalina.out to tomcat explicitly.
    Thanks to Adam Cecile for the report. (Closes: #987179)
  * Refresh 0021-dont-test-unsupported-ciphers.patch
  * tomcat9.cron.daily: Set maxdepth to 1 so that log files of custom
    applications in subdirectories of /var/log/tomcat9 are not compressed.
    Thanks to Ludovic Pouzenc for the report. (Closes: #982961)
  * Exclude TestJNDIRealmIntegration because of missing dependencies.

 -- Markus Koschany <apo@debian.org>  Fri, 24 Sep 2021 15:37:51 +0200

tomcat9 (9.0.43-3) unstable; urgency=medium

  * Team upload.
  * CVE-2021-30640: Fix NullPointerException.
    If no userRoleAttribute is specified in the user's Realm configuration its
    default value will be null. This will cause a NPE in the methods
    doFilterEscaping and doAttributeValueEscaping. This is upstream bug
    https://bz.apache.org/bugzilla/show_bug.cgi?id=65308

 -- Markus Koschany <apo@debian.org>  Tue, 10 Aug 2021 17:17:56 +0200

tomcat9 (9.0.43-2) unstable; urgency=medium

  * Team upload.

  [ mirabilos ]
  * fix /var/log/tomcat9 permissions
    fixup for commit 51128fe9fb2d4d0b56be675d845cf92e4301a6c3

  [ Markus Koschany ]
  * Fix CVE-2021-30640:
    A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to
    authenticate using variations of a valid user name and/or to bypass some of
    the protection provided by the LockOut Realm.
  * Fix CVE-2021-33037:
    Apache Tomcat did not correctly parse the HTTP transfer-encoding request
    header in some circumstances leading to the possibility to request
    smuggling when used with a reverse proxy. Specifically: - Tomcat
    incorrectly ignored the transfer encoding header if the client declared it
    would only accept an HTTP/1.0 response; - Tomcat honoured the identify
    encoding; and - Tomcat did not ensure that, if present, the chunked
    encoding was the final encoding.
    (Closes: #991046)

 -- Markus Koschany <apo@debian.org>  Sat, 07 Aug 2021 00:11:43 +0200

tomcat9 (9.0.43-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Rotate the catalina.out log file with the tomcat user (Closes: #971583)
  * Switch to debhelper level 13

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 02 Feb 2021 20:23:51 +0100

tomcat9 (9.0.41-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.5.1

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 09 Dec 2020 16:03:00 +0100

tomcat9 (9.0.40-1) unstable; urgency=medium

  [ Emmanuel Bourg ]
  * New upstream release
    - Refreshed the patches
  * Changed the home directory of the tomcat user to /var/lib/tomcat
    (Closes: #926338)

  [ Vincent McIntyre ]
  * Automatically export the JAVA_HOME environment variable when the value
    is defined in /etc/defaults/tomcat9 (Closes: #966338)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 24 Nov 2020 08:21:29 +0100

tomcat9 (9.0.39-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * tomcat9-user now depends on netcat-openbsd instead of netcat
    (Closes: #966158)

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 12 Oct 2020 17:16:57 +0200

tomcat9 (9.0.38-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 16 Sep 2020 16:04:03 +0200

tomcat9 (9.0.37-3) unstable; urgency=medium

  * control: Bump build-dep on bnd, drop bnd compat and re-export patches.
    (Closes: #964433)

 -- Timo Aaltonen <tjaalton@debian.org>  Thu, 06 Aug 2020 18:59:11 +0300

tomcat9 (9.0.37-2) unstable; urgency=medium

  * d/p/0029-fix-regression-in-bz64540.patch: Re-export util.net.jsse
    and util.modeler.modules. (Closes: #964433)

 -- Timo Aaltonen <tjaalton@debian.org>  Tue, 28 Jul 2020 14:09:13 +0300

tomcat9 (9.0.37-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Fixed the compatibility with the version of bnd in Debian
  * Restored execute permission on /var/log/tomcat9 to the adm group

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 06 Jul 2020 22:39:32 +0200

tomcat9 (9.0.36-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Grant write access on /var/log/tomcat9 to the adm group (LP: #1861881)

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 23 Jun 2020 11:47:47 +0200

tomcat9 (9.0.35-1) unstable; urgency=medium

  * New upstream release
    - Fixes CVE-2020-9484: Remote Code Execution via session persistence (Closes: #961209)
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 21 May 2020 15:50:03 +0200

tomcat9 (9.0.34-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Depend on libeclipse-jdt-core-java (>= 3.18.0)
  * Switch to debhelper level 12

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 27 Apr 2020 00:36:59 +0200

tomcat9 (9.0.31-1) unstable; urgency=medium

  * New upstream release
    - Fixes CVE-2019-10072: Denial of Service (Closes: #930872)
    - Fixes CVE-2019-12418: Local Privilege Escalation
    - Fixes CVE-2019-17563: Session fixation attack
    - Fixes CVE-2019-17569: HTTP Request Smuggling
    - Fixes CVE-2020-1935: HTTP Request Smuggling
    - Fixes CVE-2020-1938: AJP Request Injection (Closes: #952437)
    - Fixes CATALINA_PID handling in catalina.sh (Closes: #948553)
    - Refreshed the patches
    - Fixed the compilation with Java 11
  * Moved the RequiresMountsFor directive in the service file
    to the Unit section (Closes: #942316)
  * Tightened the dependency on systemd (Closes: #931997)
  * Standards-Version updated to 4.5.0

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 24 Feb 2020 23:37:00 +0100

tomcat9 (9.0.27-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.4.1

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 14 Oct 2019 11:31:50 +0200

tomcat9 (9.0.24-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 22 Aug 2019 13:55:14 +0200

tomcat9 (9.0.22-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Track and download the new releases from GitHub
  * Standards-Version updated to 4.4.0

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 12 Jul 2019 15:01:28 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog tomcat10-admin`.
