Change log for lucene-solr package in Ubuntu

lucene-solr (3.6.2+dfsg-26) unstable; urgency=medium

  * Drop libtomcat9-java from Build-Depends because we don't need it anymore.
  * Declare compliance with Debian Policy 4.6.2.

 -- Markus Koschany <email address hidden>  Sun, 19 Feb 2023 01:08:24 +0100

Available diffs

• diff from 3.6.2+dfsg-25 to 3.6.2+dfsg-26 (817 bytes)

lucene-solr (3.6.2+dfsg-25) unstable; urgency=medium

  * Team upload.
  * Build with javacc5
  * Depend on libservlet-api-java instead of libservlet3.1-java
  * Standards-Version updated to 4.6.1

 -- Emmanuel Bourg <email address hidden>  Sun, 15 May 2022 23:46:49 +0200

Available diffs

• diff from 3.6.2+dfsg-24 to 3.6.2+dfsg-25 (1.6 KiB)

lucene-solr (3.6.2+dfsg-24) unstable; urgency=medium

  * Really remove libcommons-httpclient-java from Build-Depends.
    (Closes: #800983)
  * Really fix build failure with OpenJDK 17. (Closes: #982001)

 -- Markus Koschany <email address hidden>  Sat, 27 Feb 2021 23:51:48 +0100

Available diffs

• diff from 3.6.2+dfsg-23 to 3.6.2+dfsg-24 (1.1 KiB)

lucene-solr (3.6.2+dfsg-23) unstable; urgency=medium

  * Declare compliance with Debian Policy 4.5.1.
  * Switch to debhelper-compat = 13.
  * Drop solr-tomcat, solr-jetty, solr-common and libsolr-java.
    The version of solr in Debian is outdated and newer versions are not viable
    to maintain. An alternative version packaged with jdeb or similar tools may
    be available via the contrib repository in the future.
    (Closes: #982001, #581435, #800983, #840827, #842402, #842706, #931845,
     #956464)

 -- Markus Koschany <email address hidden>  Mon, 22 Feb 2021 17:02:39 +0100

Available diffs

• diff from 3.6.2+dfsg-22 to 3.6.2+dfsg-23 (6.7 KiB)

lucene-solr (3.6.2+dfsg-8ubuntu0.1) xenial-security; urgency=medium

  * SECURITY UPDATE: Remote code execution via an XXE
    - debian/patches/CVE-2017-12629-1.patch: SOLR-11477: Disallow resolving of
      external entities in Lucene queryparser/xml/CoreParser
    - debian/patches/CVE-2017-12629-2.patch: RunExecutableListener was removed
      for security reasons
    - CVE-2017-12629

 -- Mike Salvatore <email address hidden>  Tue, 28 Jan 2020 09:00:46 -0500

Available diffs

• diff from 3.6.2+dfsg-8 (in Debian) to 3.6.2+dfsg-8ubuntu0.1 (4.0 KiB)

lucene-solr (3.6.2+dfsg-22) unstable; urgency=medium

  * Add myself to Uploaders and remove Jakub Adam, James Page and Mat Scales
    because they are not active anymore.
  * Declare compliance with Debian Policy 4.4.1.
  * Fix CVE-2019-0193:
    The DataImportHandler, an optional but popular module to pull in data from
    databases and other sources, has a feature in which the whole DIH
    configuration can come from a request's "dataConfig" parameter. The debug
    mode of the DIH admin screen uses this to allow convenient debugging /
    development of a DIH config. Since a DIH config can contain scripts, this
    parameter is a security risk. Starting from now on, use of this parameter
    requires setting the Java System property "enable.dih.dataConfigParam" to
    true. For example this can be achieved with solr-tomcat by adding
    -Denable.dih.dataConfigParam=true to JAVA_OPTS in /etc/default/tomcat9.

 -- Markus Koschany <email address hidden>  Thu, 10 Oct 2019 17:39:16 +0200

Available diffs

• diff from 3.6.2+dfsg-20 to 3.6.2+dfsg-22 (3.1 KiB)

lucene-solr (3.6.2+dfsg-20) unstable; urgency=medium

  * Team upload.
  * Remove now obsolete solr-permissions.conf in /etc/systemd/system/tomcat9.d/.

 -- Markus Koschany <email address hidden>  Thu, 25 Apr 2019 16:39:14 +0200

Available diffs

• diff from 3.6.2+dfsg-19 to 3.6.2+dfsg-20 (408 bytes)

lucene-solr (3.6.2+dfsg-19) unstable; urgency=medium

  * Team upload.
  * Install solr-permissions.conf into the correct directory.

 -- Markus Koschany <email address hidden>  Fri, 19 Apr 2019 00:39:36 +0200

Available diffs

• diff from 3.6.2+dfsg-18 to 3.6.2+dfsg-19 (409 bytes)

lucene-solr (3.6.2+dfsg-18~18.04) bionic; urgency=medium

  * Backport for OpenJDK 11. LP: #1814133.

Available diffs

• diff from 3.6.2+dfsg-14 (in Debian) to 3.6.2+dfsg-18~18.04 (4.6 KiB)
• diff from 3.6.2+dfsg-11 (in Debian) to 3.6.2+dfsg-18~18.04 (7.0 KiB)

lucene-solr (3.6.2+dfsg-18) unstable; urgency=medium

  * Team upload.
  * Add solr-permissions.conf and override tomcat9 permissions to allow
    solr-tomcat read-write access to /var/lib/solr. (Closes: #919638)

 -- Markus Koschany <email address hidden>  Sat, 02 Mar 2019 23:02:16 +0100

Available diffs

• diff from 3.6.2+dfsg-17 to 3.6.2+dfsg-18 (632 bytes)

lucene-solr (3.6.2+dfsg-17) unstable; urgency=medium

  * Team upload.
  * Do not build the lucene3 javadocs anymore. Very low popcon and build
    failures. (Closes: #917739)
  * Remove TODO.Debian.
  * Add web.xml.patch and use a correct DTD schema otherwise jasper will abort
    the build process.
  * Remove el-api.jar from the classpath to avoid a conflict with jasper-el.
  * Execute postrm commands in solr-jetty and solr-tomcat on purge too.
    (Closes: #914223)

 -- Markus Koschany <email address hidden>  Fri, 15 Feb 2019 11:21:49 +0100

Available diffs

• diff from 3.6.2+dfsg-16 to 3.6.2+dfsg-17 (2.9 KiB)

lucene-solr (3.6.2+dfsg-16) unstable; urgency=medium

  * Team upload.
  * Transition to Tomcat 9
  * Fixed the compatibility with Jetty 9.4
  * Use salsa.debian.org Vcs-* URLs

 -- Emmanuel Bourg <email address hidden>  Mon, 10 Dec 2018 22:59:36 +0100

Available diffs

• diff from 3.6.2+dfsg-15 to 3.6.2+dfsg-16 (2.2 KiB)

lucene-solr (3.6.2+dfsg-15) unstable; urgency=medium

  * Team upload.
  * Switch from libmysql-java to libmariadb-java.

 -- Markus Koschany <email address hidden>  Fri, 09 Nov 2018 17:23:59 +0100

Available diffs

• diff from 3.6.2+dfsg-14 to 3.6.2+dfsg-15 (736 bytes)

lucene-solr (3.6.2+dfsg-14) unstable; urgency=medium

  * Team upload.
  * debian/build-jars: Fix broken links to woodstox-core.jar. The jar files
    were renamed.  (Closes: #906384). This also addresses the runtime error.
    solr-tomcat works as expected again. (Closes: #904063)
  * Disable the tests and work around a FTBFS. Ideally this should been
    investigated and fixed eventually.

 -- Markus Koschany <email address hidden>  Sat, 25 Aug 2018 23:23:24 +0200

Available diffs

• diff from 3.6.2+dfsg-13 to 3.6.2+dfsg-14 (1.2 KiB)

lucene-solr (3.6.2+dfsg-10+deb9u2build0.17.10.1) artful-security; urgency=medium

  * fake sync from Debian

Available diffs

• diff from 3.6.2+dfsg-10+deb9u1build0.17.10.1 to 3.6.2+dfsg-10+deb9u2build0.17.10.1 (2.3 KiB)

lucene-solr (3.6.2+dfsg-13) unstable; urgency=medium

  * Team upload.
  * Symlink /etc/solr/solr-jetty.xml to /var/lib/jetty9/webapps/solr.xml
    to make solr-jetty work out-of-the-box.
    Thanks to Larocque for the report. (Closes: #886090)

 -- Markus Koschany <email address hidden>  Sun, 06 May 2018 20:51:06 +0200

Available diffs

• diff from 3.6.2+dfsg-12 to 3.6.2+dfsg-13 (451 bytes)

lucene-solr (3.6.2+dfsg-12) unstable; urgency=high

  * Team upload.
  * Fix FTBFS with Ant 1.10. (Closes: #895797)
  * Fix CVE-2018-1308. (Closes: #896604)
  * Declare compliance with Debian Policy 4.1.4.

 -- Markus Koschany <email address hidden>  Tue, 01 May 2018 23:35:41 +0200

Available diffs

• diff from 3.6.2+dfsg-11 to 3.6.2+dfsg-12 (2.4 KiB)

lucene-solr (3.6.2+dfsg-10+deb9u1build0.17.10.1) artful-security; urgency=medium

  * fake sync from Debian

Available diffs

• diff from 3.6.2+dfsg-10 (in Debian) to 3.6.2+dfsg-10+deb9u1build0.17.10.1 (4.8 KiB)

lucene-solr (3.6.2+dfsg-11) unstable; urgency=medium

  * Team upload.
  * Switch to compat level 11.
  * Declare compliance with Debian Policy 4.1.3.
  * Fix CVE-2017-12629: possible remote code execution by exploiting XXE. For
    security reasons the RunExecutableListener class was permanently removed.
  * Fix CVE-2017-3163: path traversal vulnerability. (Closes: #867712)

 -- Markus Koschany <email address hidden>  Sun, 14 Jan 2018 14:32:32 +0100

Available diffs

• diff from 3.6.2+dfsg-10 to 3.6.2+dfsg-11 (7.4 KiB)

lucene-solr (3.6.2+dfsg-10) unstable; urgency=medium

  * Team upload.
  * Remove obsolete Resources className directive as it does not work with
    Tomcat8. Thanks to Matthias Liertzer for the report. (Closes: #856626)

 -- Markus Koschany <email address hidden>  Thu, 30 Mar 2017 20:24:00 +0200

Available diffs

• diff from 3.6.2+dfsg-9 to 3.6.2+dfsg-10 (687 bytes)

lucene-solr (3.6.2+dfsg-9) unstable; urgency=medium

  * Team upload.

  [ Emmanuel Bourg ]
  * Switched the dependencies to tomcat8, libservlet3.1-java and jetty9
  * Standards-Version updated to 3.9.8
  * Use a secure Vcs-* URL
  * Fixed the watch file

  [ tony mancill ]
  * Add Dutch translation of debconf messages. (Closes: #835136)
    Thank you to Frans Spiesschaert for the translation.

 -- Emmanuel Bourg <email address hidden>  Mon, 24 Oct 2016 17:10:19 +0200

Available diffs

• diff from 3.6.2+dfsg-8 to 3.6.2+dfsg-9 (6.0 KiB)

lucene-solr (3.6.2+dfsg-8) unstable; urgency=medium

  * Team upload.
  * Transition to bnd 2.1.0.
  * Fix Lintian warning empty-short-license-in-dep5-copyright.
  * Fix Lintian warnings command-with-path-in-maintainer-script.
  * Vcs-Browser: Use https.

 -- Markus Koschany <email address hidden>  Thu, 19 Nov 2015 22:13:50 +0100

Available diffs

• diff from 3.6.2+dfsg-7 to 3.6.2+dfsg-8 (1.3 KiB)

lucene-solr (3.6.2+dfsg-7) unstable; urgency=medium

  * Add OSGi metadata to JAR manifests
  * Add Jakub Adam to Uploaders
  * Update file paths in d/copyright

 -- Jakub Adam <email address hidden>  Mon, 03 Aug 2015 15:49:56 +0200

Available diffs

• diff from 3.6.2+dfsg-6 to 3.6.2+dfsg-7 (1.3 KiB)

lucene-solr (3.6.2+dfsg-6) unstable; urgency=medium

  * Team upload.

  [ Emmanuel Bourg ]
  * Removed the dependency on libgeronimo-stax-1.2-spec-java
  * Fixed a test failure with commons-codec 1.10
  * Fixed a test failure with Java 8 (Closes: #760927)
  * Use XZ compression for the upstream tarball
  * debian/watch: No longer use the defunct githubredir.debian.net redirector

  [ Victor Seva ]
  * solr-tomcat: allow tomcat7-user as depends (Closes: #606138)

 -- Emmanuel Bourg <email address hidden>  Mon, 13 Jul 2015 14:45:06 +0200

Available diffs

• diff from 3.6.2+dfsg-5 to 3.6.2+dfsg-6 (3.0 KiB)

lucene-solr (3.6.2+dfsg-5) unstable; urgency=medium


  * Team upload.
  * Fixed the deployment with Jetty 8 (Closes: #752547, #767525)
  * Enable the symbolic links with Jetty (Closes: #701876)
  * Fixed the path to dpkg-statoverride in solr-jetty.postrm (Closes: #767519)

 -- Emmanuel Bourg <email address hidden>  Fri, 31 Oct 2014 19:28:25 +0100

Available diffs

• diff from 3.6.2+dfsg-4 to 3.6.2+dfsg-5 (1.2 KiB)

lucene-solr (3.6.2+dfsg-4) unstable; urgency=medium


  * Team upload.
  * Switched the dependencies to tomcat7, libservlet3.0-java and jetty8
  * Fixed a format issue with CVE-2013-6397.patch
  * Standards-Version updated to 3.9.6 (no changes)

 -- Emmanuel Bourg <email address hidden>  Mon, 06 Oct 2014 15:47:56 +0200

Available diffs

• diff from 3.6.2+dfsg-3 to 3.6.2+dfsg-4 (4.1 KiB)

lucene-solr (3.6.2+dfsg-3) unstable; urgency=medium


  * Team upload.
  * Add tomcat-coyote to debian/build-jars to address FTBFS.
    (Closes: #749364)
  * Update Vcs- URLs in debian/control.
  * Use debhelper 9.
  * Bump Standards-Version to 3.9.5.

 -- tony mancill <email address hidden>  Tue, 10 Jun 2014 22:29:19 -0700

Available diffs

• diff from 3.6.2+dfsg-2 to 3.6.2+dfsg-3 (952 bytes)

lucene-solr (3.6.2+dfsg-2) unstable; urgency=low


  * Fixes for new security vulnerabilities (Closes: #731113):
    - debian/patches/CVE-2013-6397.patch:
      Fix DocumentAnalysisRequestHandler to correctly use
      EmptyEntityResolver to prevent loading of external entities like
      UpdateRequestHandler does.
      CVE-2013-6397
    - debian/patches/CVE-2013-6407_CVE-2013-6408.patch:
      XML and XSLT UpdateRequestHandler should not try to
      resolve external entities. This improves speed of loading e.g.
      XSL-transformed XHTML documents.
      CVE-2013-6407
      Fix XML parsing in XPathEntityProcessor to correctly
      expand named entities, but ignore external entities.
      CVE-2013-6408

 -- James Page <email address hidden>  Sat, 14 Dec 2013 22:07:54 +0000

Available diffs

• diff from 3.6.2+dfsg-1 to 3.6.2+dfsg-2 (8.0 KiB)

lucene-solr (3.6.2+dfsg-1) unstable; urgency=low


  * Upload to unstable.

 -- James Page <email address hidden>  Thu, 16 May 2013 10:45:27 +0100

Available diffs

• diff from 3.6.2+dfsg-1~exp1 to 3.6.2+dfsg-1 (334 bytes)

lucene-solr (3.6.2+dfsg-1~exp1) experimental; urgency=low


  [ tony mancill ]
  * solr-jetty: correct symlink to solr in /var/lib/jetty/webapps/
    (Closes: #696347)

  [ James Page ]
  * New upstream release.
  * d/copyright: Removed surplus GPL-2 paragraph.
  * d/control: Tidied short descriptions.

 -- James Page <email address hidden>  Mon, 07 Jan 2013 14:23:47 +0000

Available diffs

• diff from 3.6.1+dfsg-1 to 3.6.2+dfsg-1~exp1 (32.7 KiB)

lucene-solr (3.6.1+dfsg-1) experimental; urgency=low


  * New upstream release.
  * Add dependency on JDK for solr-jetty (LP: #1046732):
    - d/control: Add extra Depends on default-jdk | java5-jdk as jetty
      requires a full JDK to support use of JSP's which solr uses. 

 -- James Page <email address hidden>  Wed, 21 Nov 2012 09:31:05 +0000

Available diffs

• diff from 3.6.1+dfsg-0ubuntu2 (in Ubuntu) to 3.6.1+dfsg-1 (746 bytes)

lucene-solr (3.6.1+dfsg-0ubuntu2) quantal; urgency=low

  * Add dependency on JDK for solr-jetty (LP: #1046732):
    - d/control: Add extra Depends on default-jdk | java5-jdk as jetty
      requires a full JDK to support use of JSP's which solr uses.
 -- James Page <email address hidden>   Thu, 06 Sep 2012 11:07:52 +0100

Available diffs

• diff from 3.6.1+dfsg-0ubuntu1 to 3.6.1+dfsg-0ubuntu2 (630 bytes)

lucene-solr (3.6.1+dfsg-0ubuntu1) quantal; urgency=low

  * New upstream release.
 -- James Page <email address hidden>   Mon, 23 Jul 2012 16:37:53 +0100

Available diffs

• diff from 3.6.0+dfsg-1 (in Debian) to 3.6.1+dfsg-0ubuntu1 (103.7 KiB)

lucene-solr (3.6.0+dfsg-1) unstable; urgency=low


  * Initial release. (Closes: #594027)

 -- James Page <email address hidden>  Tue, 29 May 2012 17:32:24 +0100