-
lucene-solr (3.6.2+dfsg-24) unstable; urgency=medium
* Really remove libcommons-httpclient-java from Build-Depends.
(Closes: #800983)
* Really fix build failure with OpenJDK 17. (Closes: #982001)
-- Markus Koschany <email address hidden> Sat, 27 Feb 2021 23:51:48 +0100
-
lucene-solr (3.6.2+dfsg-23) unstable; urgency=medium
* Declare compliance with Debian Policy 4.5.1.
* Switch to debhelper-compat = 13.
* Drop solr-tomcat, solr-jetty, solr-common and libsolr-java.
The version of solr in Debian is outdated and newer versions are not viable
to maintain. An alternative version packaged with jdeb or similar tools may
be available via the contrib repository in the future.
(Closes: #982001, #581435, #800983, #840827, #842402, #842706, #931845,
#956464)
-- Markus Koschany <email address hidden> Mon, 22 Feb 2021 17:02:39 +0100
-
lucene-solr (3.6.2+dfsg-22) unstable; urgency=medium
* Add myself to Uploaders and remove Jakub Adam, James Page and Mat Scales
because they are not active anymore.
* Declare compliance with Debian Policy 4.4.1.
* Fix CVE-2019-0193:
The DataImportHandler, an optional but popular module to pull in data from
databases and other sources, has a feature in which the whole DIH
configuration can come from a request's "dataConfig" parameter. The debug
mode of the DIH admin screen uses this to allow convenient debugging /
development of a DIH config. Since a DIH config can contain scripts, this
parameter is a security risk. Starting from now on, use of this parameter
requires setting the Java System property "enable.dih.dataConfigParam" to
true. For example this can be achieved with solr-tomcat by adding
-Denable.dih.dataConfigParam=true to JAVA_OPTS in /etc/default/tomcat9.
-- Markus Koschany <email address hidden> Thu, 10 Oct 2019 17:39:16 +0200
