commons-configuration2 (2.8.0-1~deb11u1) bullseye-security; urgency=high * Team upload. * Backport version 2.8.0 from Bullseye. * Fix CVE-2022-33980: Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. (Closes: #1014960) -- Markus Koschany Mon, 28 Nov 2022 10:52:07 +0100 commons-configuration2 (2.8.0-1) unstable; urgency=medium * Team upload. * New upstream version 2.8.0 (Closes: #1014960) Addresses CVE-2022-33980 * Bump Standards-Version to 4.6.1 * Use debhelper-compat 13 * Freshen years in debian/copyright * Update javax.servlet dependency to libservlet-api-java * Add build-dep on libhamcrest-java -- tony mancill Sat, 16 Jul 2022 09:53:15 -0700 commons-configuration2 (2.7-2) unstable; urgency=medium * Team upload. * Add commons-text.jar to the CLASSPATH. Without commons-text.jar packages like MediathekView will not work anymore. (Closes: #955755) -- Markus Koschany Sun, 05 Apr 2020 15:33:44 +0200 commons-configuration2 (2.7-1) unstable; urgency=medium * Team upload * Update debian/watch to repack as .xz and use https URL * New upstream version 2.7, CVE-2020-1953 (Closes: #954713) * Specify debhelper compat 12 via debhelper-compat dependency * Add build-dep on libcommons-text-java * Remove get-orig-source target from debian/rules * Set source and target in maven.properites to Java 8 * Specify debhelper compat 12 via debhelper-compat dependency * Add build-dep on libcommons-text-java * Remove get-orig-source target from debian/rules * Set source and target in maven.properites to Java 8 * Set "Rules-Requires-Root: no" in debian/control * Bump Standards-Version to 4.5.0 * Freshen years in debian/copyright * Update Vcs URLs to point to Salsa * Ship NOTICE.txt with binary package -- tony mancill Sat, 28 Mar 2020 21:32:41 -0700 commons-configuration2 (2.2-1) unstable; urgency=medium * New upstream release - New dependency on libjackson2-databind-java and libyaml-snake-java * Standards-Version updated to 4.1.3 -- Emmanuel Bourg Fri, 29 Dec 2017 23:12:51 +0100 commons-configuration2 (2.1.1-1) unstable; urgency=medium * Cloned the package as commons-configuration2 * New upstream release - New dependency on libspring-context-java - Removed the dependency on commons-collections -- Emmanuel Bourg Wed, 28 Jun 2017 15:25:32 +0200 commons-configuration (1.10-5) unstable; urgency=medium * Removed the unused build dependency on ant * Standards-Version updated to 4.0.0 * Switch to debhelper level 10 * Use secure Vcs-* URLs -- Emmanuel Bourg Wed, 28 Jun 2017 13:59:09 +0200 commons-configuration (1.10-4) unstable; urgency=medium * Ignore the scm-publish plugin to fix the build failure with Maven 3 * Build with the DH sequencer instead of CDBS * Suggest the optional dependencies instead of recommending them -- Emmanuel Bourg Thu, 17 Dec 2015 09:00:26 +0100 commons-configuration (1.10-3) unstable; urgency=medium * Team upload. * Moved the package to Git * Add missing build-dep on libeasymock-java. (Closes: #797853) -- tony mancill Wed, 02 Sep 2015 21:48:55 -0700 commons-configuration (1.10-2) unstable; urgency=medium * Replaced the build dependency on libgnumail-java with libmail-java * Upgraded the dependency on the Servlet API (3.0 -> 3.1) * Updated Standards-Version to 3.9.6 (no changes) -- Emmanuel Bourg Tue, 30 Sep 2014 09:16:31 +0200 commons-configuration (1.10-1) unstable; urgency=low * New upstream release * debian/control: Updated Standards-Version to 3.9.5 (no changes) * Build depend on debhelper >= 9 -- Emmanuel Bourg Sat, 02 Nov 2013 07:38:45 +0100 commons-configuration (1.9-1) unstable; urgency=low * New upstream release (Closes: #675966) * debian/control: - Updated Standards-Version to 3.9.4 (no changes) - Use canonical URLs for the Vcs-* fields - Added new build dependencies (libjavacc-maven-plugin-java, junit4) - Upgraded the dependency on the Servlet API (2.5 -> 3.0) - Removed the dependency on the Activation Framework (glassfish-activation) - Replaced the dependency on glassfish-mail with libgnumail-java - Removed the unused dependencies: liblog4j1.2-java-doc, libmaven-assembly-plugin-java - Replaced the dependency on libcommons-jexl-java by libcommons-jexl2-java * debian/watch: Changed to point the official Apache distribution server * Removed the obsolete file debian/ant.properties * Installed the upstream changelog in the binary packages * Added the report plugins to maven.ignoreRules * Added the classpath attribute to the jar manifest -- Emmanuel Bourg Mon, 01 Jul 2013 16:29:44 +0200 commons-configuration (1.7-1) unstable; urgency=low * New upstream release: - Drop all previous patches. - Add B-D on libcommons-vfs-java (>= 2.0), libcommons-dbcp-java, libcommons-pool-java, glassfish-mail and glassfish-activation. * Bump Standards-Version 3.9.2: no changes needed. * d/copyright: Use DEP-5 format. * Switch to Maven build system: - Add B-D on maven-debian-helper - Use ${maven:Depends} and ${maven:OptionalDepends} for Depends and Recommends. -- Damien Raude-Morvan Sun, 11 Sep 2011 00:55:11 +0200 commons-configuration (1.6-6) unstable; urgency=low * Add myself as Uploaders. * Switch to servlet-api 2.5: - d/control: Update Build-Depends and Depends to libservlet2.5-java. - d/rules: Set DEB_JARS to servlet-api-2.5. * Use default-jdk for build. * d/control: Drop Depends on classpath-doc but add Recommends on default-jdk-doc. (Closes: #567269). * d/control: Fix Vcs-* to use anonymous connection. * d/control: Update Standards-Version to 3.9.2: no changes needed. * Bump debhelper compat level to 7. * d/control: Remove Suggests on java-virtual-machine. -- Damien Raude-Morvan Sun, 04 Sep 2011 14:19:17 +0200 commons-configuration (1.6-5) unstable; urgency=low * Change Build-Depends: default-jdk-doc. * Convert copyright file to UTF-8. * Switch to source format 3.0. * Update Standards-Version: 3.8.4 -- Torsten Werner Sun, 11 Apr 2010 16:00:02 +0200 commons-configuration (1.6-4) unstable; urgency=low * Upload to unstable. -- Torsten Werner Sun, 09 Aug 2009 10:41:44 +0200 commons-configuration (1.6-3) experimental; urgency=low * Update debian/control as previous version missed all my changes * Use openjdk-6-jdk for the build; add a Build-Depends on this package. -- Ludovic Claude Sun, 12 Jul 2009 23:20:28 +0100 commons-configuration (1.6-2) experimental; urgency=low [ Ludovic Claude ] * Change section to java, bump up Standards-Version to 3.8.1 * Add the Maven POM to the package, * Add a Build-Depends-Indep dependency on maven-repo-helper * Use mh_installpom and mh_installjar to install the POM and the jar to the Maven repository * Add missing dependencies on the binary package * Add new java-doc package * Use default-jdk to build the package, otherwise javadoc generation fails [ Torsten Werner ] * Fix Build-Depends. * Upload to experimental. -- Torsten Werner Sun, 12 Jul 2009 22:45:20 +0200 commons-configuration (1.6-1) unstable; urgency=low * new upstream release * Refresh our patches. -- Torsten Werner Sat, 10 Jan 2009 12:54:01 +0100 commons-configuration (1.5-2) unstable; urgency=low * Change Maintainer to the pkg-java team. * Bump up Standards-Version: 3.8.0 (no changes needed). * Do no longer quote the full text of the Apache license in debian/copyright. -- Torsten Werner Fri, 15 Aug 2008 01:39:18 +0200 commons-configuration (1.5-1) unstable; urgency=low * new upstream release * Move package to Alioth and add Vcs headers in debian/control. * Update all references to the homepage and download address to the new apache structure. (Closes: #450063) * Add target 'get-orig-source' to debian/rules. * Bumped up Standards-Version to 3.7.3; no changes needed. * Switch from kaffe to java-gcj-compat-dev. -- Torsten Werner Sun, 09 Dec 2007 10:50:51 +0100 commons-configuration (1.4-2) unstable; urgency=low * Remove some of the Depends because one of them was wrong and the others might not be real Depends. (Closes: #425017) -- Torsten Werner Fri, 18 May 2007 18:43:24 +0200 commons-configuration (1.4-1) unstable; urgency=low * Initial release (Closes: #420165) -- Torsten Werner Fri, 20 Apr 2007 15:42:11 +0200