jetty9 (9.4.57-1.1~deb12u1) bookworm-security; urgency=medium

  * Non-maintainer upload.
  * Rebuild for bookworm-security.

 -- Adrian Bunk <bunk@debian.org>  Sun, 07 Sep 2025 16:19:54 +0300

jetty9 (9.4.57-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * CVE-2025-5115: MadeYouReset HTTP/2 vulnerability (Closes: #1111766)

 -- Adrian Bunk <bunk@debian.org>  Fri, 05 Sep 2025 08:55:56 +0300

jetty9 (9.4.57-1) unstable; urgency=medium

  * New upstream release

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 03 Mar 2025 13:04:12 +0100

jetty9 (9.4.56-1) unstable; urgency=medium

  * New upstream release

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 07 Oct 2024 17:27:31 +0200

jetty9 (9.4.55-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.7.0

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 02 Aug 2024 08:55:22 +0200

jetty9 (9.4.54-1) unstable; urgency=high

  * Team upload.
  * New upstream version 9.4.54.
    - Fix CVE-2024-22201:
      It was discovered that remote attackers may leave many HTTP/2 connections
      in ESTABLISHED state (not closed), TCP congested and idle. Eventually the
      server will stop accepting new connections from valid clients which can
      cause a denial of service. (Closes: #1064923)
      Thanks to Salvatore Bonaccorso for the report.

 -- Markus Koschany <apo@debian.org>  Sat, 06 Apr 2024 12:54:58 +0200

jetty9 (9.4.53-1) unstable; urgency=medium

  * New upstream release

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 09 Oct 2023 23:07:28 +0200

jetty9 (9.4.52-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.4.52.
  * Refresh the patches.

 -- Markus Koschany <apo@debian.org>  Sun, 24 Sep 2023 01:40:05 +0200

jetty9 (9.4.51-2) experimental; urgency=medium

  * Team upload.
  * Revert switch to libtomcat10-java. (Closes: #1036798)

 -- Markus Koschany <apo@debian.org>  Sat, 27 May 2023 16:47:13 +0200

jetty9 (9.4.50-4) unstable; urgency=medium

  * Team upload.
  * Revert the switch to libtomcat10-java. For now Jetty 9 only works correctly
    with libtomcat9-java. (Closes: #1036798)

 -- Markus Koschany <apo@debian.org>  Sat, 27 May 2023 16:28:19 +0200

jetty9 (9.4.51-1) experimental; urgency=medium

  * Team upload.
  * New upstream release.
  * Replace dependency on lsb-base with sysvinit-utils.
    - Fix: lintian error depends-on-obsolete-package.
  * Add a systemd timer for debian/jetty9.service.
    - Fix: lintian warning missing-systemd-timer-for-cron-script.
  * Fix lintian warning skip-systemd-native-flag-missing-pre-depends.
  * Fix lintian warning mismatched-override.

 -- sun min <sunmin89@outlook.com>  Wed, 29 Mar 2023 10:10:33 +0800

jetty9 (9.4.50-3) unstable; urgency=medium

  * Team upload.
  * Depend on libtomcat10-java instead of libtomcat9-java.
  * Add tomcat10-migration.patch.
  * Ignore jetty-jaspi module because it does not work with Tomcat 10 yet.

 -- Markus Koschany <apo@debian.org>  Sun, 19 Feb 2023 13:41:00 +0100

jetty9 (9.4.50-2) unstable; urgency=medium

  * Depend on libeclipse-jdt-core-java instead of libecj-java
  * Standards-Version updated to 4.6.2

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 06 Jan 2023 12:08:38 +0100

jetty9 (9.4.50-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Sun, 27 Nov 2022 22:47:21 +0100

jetty9 (9.4.49-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.4.49.

 -- Markus Koschany <apo@debian.org>  Thu, 22 Sep 2022 23:41:17 +0200

jetty9 (9.4.48-1) unstable; urgency=high

  * Team upload.
  * New upstream version 9.4.48.
    - Fix CVE-2022-2048 and CVE-2022-2047.

 -- Markus Koschany <apo@debian.org>  Mon, 18 Jul 2022 13:26:56 +0200

jetty9 (9.4.46-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 02 May 2022 18:42:20 +0200

jetty9 (9.4.45-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 9.4.45.
  * Remove haproxy binary file from the sources.

 -- Markus Koschany <apo@debian.org>  Fri, 11 Feb 2022 11:13:49 +0100

jetty9 (9.4.44-4) unstable; urgency=medium

  * Team upload.
  * Add servlet-api.patch and correct the API version in jetty-home/pom.xml.
    This used to work because libservlet3.1-java was pulled in as a transitive
    dependency. (Closes: #1002274)

 -- Markus Koschany <apo@debian.org>  Sat, 25 Dec 2021 23:37:56 +0100

jetty9 (9.4.44-3) unstable; urgency=medium

  * Team upload.
  * Ignore junit-bom artifact of scope import.
    The junit-bom dependency caused several FTBFS because of
    reverse-dependencies that did not depend on junit5.

 -- Markus Koschany <apo@debian.org>  Fri, 12 Nov 2021 12:14:57 +0100

jetty9 (9.4.44-2) unstable; urgency=medium

  * Team upload.
  * Update README.Debian and clarify how to override systemd security features.
    (Closes: #994440)
  * Replace deprecated configuration options in start.ini.
    Thanks to Martin van Es for the report. (Closes: #994441)

 -- Markus Koschany <apo@debian.org>  Mon, 18 Oct 2021 11:51:58 +0200

jetty9 (9.4.44-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Updated the Maven rules
  * Depend on libservlet-api-java instead of libservlet3.1-java
  * No longer remove the jetty user/group when purging the package
  * Standards-Version updated to 4.6.0.1
  * Switch to debhelper level 13

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 18 Oct 2021 10:56:29 +0200

jetty9 (9.4.39-3) unstable; urgency=high

  * Team upload.
  * Fix CVE-2021-34429:
    URIs can be crafted using some encoded characters to access the content of
    the WEB-INF directory and/or bypass some security constraints.
    Thanks to Salvatore Bonaccorso for the report. (Closes: #991188)

 -- Markus Koschany <apo@debian.org>  Sun, 18 Jul 2021 19:37:57 +0200

jetty9 (9.4.39-2) unstable; urgency=high

  * Team upload.
  * Fix CVE-2021-28169:
    It is possible for requests to the ConcatServlet with a doubly encoded path
    to access protected resources within the WEB-INF directory. For example a
    request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file.
    This can reveal sensitive information regarding the implementation of a web
    application.
  * Fix CVE-2021-34428:
    If an exception is thrown from the SessionListener#sessionDestroyed()
    method, then the session ID is not invalidated in the session ID manager.
    On deployments with clustered sessions and multiple contexts this can
    result in a session not being invalidated. This can result in an
    application used on a shared computer being left logged in.

    Thanks to Salvatore Bonaccorso for the report. (Closes: #989999, #990578)

 -- Markus Koschany <apo@debian.org>  Sat, 03 Jul 2021 19:09:58 +0200

jetty9 (9.4.39-1) unstable; urgency=high

  * New upstream release
    - Fixed CVE-2021-28163: If a user uses a webapps directory that is a
      symlink, the contents of the webapps directory is deployed as a static
      webapp, inadvertently serving the webapps themselves and anything else
      that might be in that directory.
    - Fixes CVE-2021-28164: The default compliance mode allows requests with
      URIs that contain %2e or %2e%2e segments to access protected resources
      within the WEB-INF directory. This can reveal sensitive information
      regarding the implementation of a web application.
    - Fixes CVE-2021-28165: CPU usage can reach 100% upon receiving a large
      invalid TLS frame.

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 12 Apr 2021 00:11:03 +0200

jetty9 (9.4.38-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Sun, 28 Feb 2021 21:50:15 +0100

jetty9 (9.4.36-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Sun, 17 Jan 2021 23:49:54 +0100

jetty9 (9.4.35-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Standards-Version updated to 4.5.1

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 30 Dec 2020 23:49:47 +0100

jetty9 (9.4.33-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 22 Oct 2020 09:57:19 +0200

jetty9 (9.4.31-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 03 Sep 2020 14:26:52 +0200

jetty9 (9.4.29-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 27 May 2020 17:59:57 +0200

jetty9 (9.4.28-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
  * Switch to debhelper level 12

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 14 Apr 2020 01:20:44 +0200

jetty9 (9.4.27-1) unstable; urgency=medium

  * New upstream release

 -- Emmanuel Bourg <ebourg@apache.org>  Sun, 05 Apr 2020 17:46:58 +0200

jetty9 (9.4.26-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patches
    - Updated the Maven rules
    - Build the new jetty-openid module
    - Replaced the jetty-cdi-* artifacts with the unified jetty-cdi one
  * Standards-Version updated to 4.5.0

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 28 Jan 2020 00:23:26 +0100

jetty9 (9.4.18-2) unstable; urgency=medium

  * Team upload to unstable.
  * Add missing dependency on libecj-java (Closes: #924168)
  * Bump Standards-Version to 4.4.0
  * Add NOTICE.txt to be installed in /usr/share/doc/jetty9

 -- tony mancill <tmancill@debian.org>  Fri, 12 Jul 2019 06:22:42 -0700

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog jetty9`.
