undertow (1.4.23-3ubuntu0.1~esm1) bionic-security; urgency=medium

  * SECURITY UPDATE: user session takeover issue
    - debian/patches/CVE-2025-12543-1.patch: Add handler to scrutinize Host
      header in request. Fix IP regex patterns to have proper range and
      include embedded adr
    - debian/patches/CVE-2025-12543-2.patch: Add checks for empty Host
      header
    - CVE-2025-12543

 -- Nishit Majithia <nishit.majithia@canonical.com>  Wed, 01 Apr 2026 12:10:02 +0530

undertow (1.4.23-3) unstable; urgency=medium

  * Rebuild against libjboss-classfilewriter-java >= 1.2.2-2.
    Fix unsatisfiable dependency.

 -- Markus Koschany <apo@debian.org>  Mon, 26 Mar 2018 20:15:01 +0200

undertow (1.4.23-2) unstable; urgency=medium

  * Add java9.patch and fix FTBFS with Java 9. (Closes: #893532)
  * Use source/target 1.9.

 -- Markus Koschany <apo@debian.org>  Sun, 25 Mar 2018 17:06:48 +0200

undertow (1.4.23-1) unstable; urgency=high

  * New upstream version 1.4.23.
    - Fix CVE-2017-7559: HTTP Request smuggling vulnerability.
      (Closes: #885576)

 -- Markus Koschany <apo@debian.org>  Fri, 02 Mar 2018 20:29:02 +0100

undertow (1.4.22-1) unstable; urgency=medium

  * New upstream version 1.4.22.
  * Use compat level 11.
  * Declare compliance with Debian Policy 4.1.3.
  * Drop websockets-jsr.patch. Not needed anymore.

 -- Markus Koschany <apo@debian.org>  Wed, 17 Jan 2018 21:11:59 +0100

undertow (1.4.21-2) unstable; urgency=medium

  * Add websockets-jsr.patch and implement a yet unsupported new method
    introduced by the recent update of libtomcat8-java to version 8.5.24.
    Thanks to Adrian Bunk for the report. (Closes: #883357)
  * Declare compliance with Debian Policy 4.1.2.

 -- Markus Koschany <apo@debian.org>  Sun, 03 Dec 2017 20:49:51 +0100

undertow (1.4.21-1) unstable; urgency=medium

  * New upstream version 1.4.21.
  * Declare compliance with Debian Policy 4.1.1.

 -- Markus Koschany <apo@debian.org>  Thu, 02 Nov 2017 14:14:55 +0100

undertow (1.4.20-1) unstable; urgency=medium

  * New upstream version 1.4.20.
  * Tighten build-dependency on jboss-xnio.
  * Add no-wildfly.patch and don't require the wildfly openssl dependency.
  * Declare compliance with Debian Policy 4.1.0.

 -- Markus Koschany <apo@debian.org>  Tue, 19 Sep 2017 19:58:15 +0200

undertow (1.4.18-1) unstable; urgency=medium

  * New upstream version 1.4.18.
    - Fixes CVE-2017-2666 and CVE-2017-2670. (Closes: #864405)
  * Declare compliance with Debian Policy 4.0.0.
  * Use https for Format field.
  * Ignore zanata-maven-plugin.
  * Ignore karaf submodule.
  * Add libmaven-bundle-plugin-java to B-D.
  * Remove lintian-overrides file.

 -- Markus Koschany <apo@debian.org>  Thu, 29 Jun 2017 18:05:28 +0200

undertow (1.4.8-1) unstable; urgency=medium

  * New upstream version 1.4.8.

 -- Markus Koschany <apo@debian.org>  Fri, 23 Dec 2016 00:17:42 +0100

undertow (1.4.7-1) unstable; urgency=medium

  * New upstream version 1.4.7.

 -- Markus Koschany <apo@debian.org>  Sun, 18 Dec 2016 00:12:45 +0100

undertow (1.4.6-1) unstable; urgency=medium

  * New upstream version 1.4.6.

 -- Markus Koschany <apo@debian.org>  Mon, 28 Nov 2016 22:46:45 +0100

undertow (1.4.4-1) unstable; urgency=medium

  * New upstream version 1.4.4.

 -- Markus Koschany <apo@debian.org>  Sat, 29 Oct 2016 18:29:08 +0200

undertow (1.4.3-1) unstable; urgency=medium

  * New upstream version 1.4.3.
    - Fixes CVE-2016-7046. (Closes: #838600)
      Thanks to Salvatore Bonaccorso for the report.
  * Switch to compat level 10.
  * debian/watch: Use version=4.

 -- Markus Koschany <apo@debian.org>  Fri, 23 Sep 2016 19:18:11 +0200

undertow (1.4.1-1) unstable; urgency=medium

  * New upstream version 1.4.1.
  * Ignore org.wildfly.openssl:wildfly-openssl.

 -- Markus Koschany <apo@debian.org>  Fri, 09 Sep 2016 02:21:45 +0200

undertow (1.4.0-1) unstable; urgency=medium

  * Imported Upstream version 1.4.0.

 -- Markus Koschany <apo@debian.org>  Fri, 05 Aug 2016 12:14:46 +0200

undertow (1.3.23-1) unstable; urgency=medium

  * Imported Upstream version 1.3.23.
  * Declare compliance with Debian Policy 3.9.8.
  * Drop JettyALPNClientProvider.patch. Fixed upstream.

 -- Markus Koschany <apo@debian.org>  Sun, 05 Jun 2016 17:47:27 +0200

undertow (1.3.21-1) unstable; urgency=medium

  * Imported Upstream version 1.3.21.
  * Remove http2 test suite from libundertow-java.poms and
    maven.rules.
  * Add JettyALPNClientProvider.patch and fix multiple compilation errors.

 -- Markus Koschany <apo@debian.org>  Sun, 10 Apr 2016 20:12:33 +0200

undertow (1.3.19-1) unstable; urgency=medium

  * Imported Upstream version 1.3.19.
  * Declare compliance with Debian Policy 3.9.7.

 -- Markus Koschany <apo@debian.org>  Sun, 20 Mar 2016 19:17:54 +0100

undertow (1.3.16-1) unstable; urgency=medium

  * Imported Upstream version 1.3.16.
  * Vcs-Git: Use https.

 -- Markus Koschany <apo@debian.org>  Sat, 30 Jan 2016 17:03:04 +0100

undertow (1.3.11-1) unstable; urgency=medium

  * debian/rules: Do not execute dh_auto_test to prevent a FTBFS due
    to a bug in maven-compiler-plugin 3.2. (Closes: #808691)
  * Imported Upstream version 1.3.11.

 -- Markus Koschany <apo@debian.org>  Thu, 24 Dec 2015 19:56:00 +0100

undertow (1.3.7-1) unstable; urgency=medium

  * Imported Upstream version 1.3.7.

 -- Markus Koschany <apo@debian.org>  Fri, 27 Nov 2015 19:40:51 +0100

undertow (1.3.5-1) unstable; urgency=medium

  * Imported Upstream version 1.3.5.
  * Change homepage field to undertow.io.

 -- Markus Koschany <apo@debian.org>  Mon, 16 Nov 2015 17:25:21 +0100

undertow (1.3.4-1) unstable; urgency=medium

  * Initial release (Closes: #767001)

 -- Markus Koschany <apo@debian.org>  Mon, 02 Nov 2015 17:57:08 +0100
