axis (1.4-25+deb9u1) stretch-security; urgency=high

  * Non-maintainer upload by the LTS Team.
  * CVE-2018-8032
    Cross-site scripting (XSS) attack in the default servlet/services.

 -- Thorsten Alteholz <debian@alteholz.de>  Tue, 16 Nov 2021 00:03:02 +0100

axis (1.4-25) unstable; urgency=medium

  * Fixed the build failure with Ant 1.9.8 (Closes: #851030)
  * Moved the package to Git
  * Standards-Version updated to 3.9.8
  * Switch to debhelper level 10

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 12 Jan 2017 18:28:23 +0100

axis (1.4-24) unstable; urgency=medium

  * Team upload.
  * Restored the missing Export-Package attributes

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 15 Jan 2016 22:33:32 +0100

axis (1.4-23) unstable; urgency=medium

  * Team upload.
  * Transition to bnd 2.1.0.
  * Vcs-Browser: Use https.
  * wrap-and-sort -sa.

 -- Markus Koschany <apo@debian.org>  Tue, 17 Nov 2015 16:53:49 +0100

axis (1.4-22) unstable; urgency=medium

  * Updated the dependency on the Servlet API (3.0 -> 3.1)
  * libaxis-java no longer depends on the Servlet API since it's always
    provided by the web container executing Axis.
  * Replaced the dependency on libgnumail-java with libmail-java

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 17 Oct 2014 13:23:45 +0200

axis (1.4-21) unstable; urgency=high

  * Team upload.
  * Fix CVE-2014-3596.
    - Replace 06-fix-CVE-2012-5784.patch with CVE-2014-3596.patch which fixes
      both CVE issues. Thanks to Raphael Hertzog for the report.
    - The getCN function in Apache Axis 1.4 and earlier does not properly
      verify that the server hostname matches a domain name in the subject's
      Common Name (CN) or subjectAltName field of the X.509 certificate,
      which allows man-in-the-middle attackers to spoof SSL servers via a
      certificate with a subject that specifies a common name in a field
      that is not the CN field.  NOTE: this issue exists because of an
      incomplete fix for CVE-2012-5784.
    - (Closes: #762444)
  * Declare compliance with Debian Policy 3.9.6.
  * Use compat level 9 and require debhelper >=9.
  * Use canonical VCS fields.

 -- Markus Koschany <apo@gambaru.de>  Thu, 25 Sep 2014 19:45:08 +0000

axis (1.4-20) unstable; urgency=low

  * Updated the dependency on the Servlet API (2.5 -> 3.0)
  * Removed the obsolete dependency on the Activation Framework (libgnujaf-java)
  * Added the upstream changelog
  * debian/rules: Improved the clean target to allow rebuilds

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 15 May 2013 00:56:15 +0200

axis (1.4-19) unstable; urgency=low

  * Team upload.
  * Upload to unstable.

 -- tony mancill <tmancill@debian.org>  Mon, 13 May 2013 22:00:05 -0700

axis (1.4-18) experimental; urgency=low

  * Team upload.
  * debian/watch: Fixed the URL
  * debian/control: Add Emmanuel Bourg to list of Uploaders.

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 02 Apr 2013 17:02:15 +0200

axis (1.4-17) experimental; urgency=low

  * Team upload.

  [ Jakub Adam ]
  * Use bnd to generate OSGi metadata.
  * Remove Michael Koch from Uploaders (Closes: #653992).
    - Thanks for your contribution to this package.
  * Bump Standards-Version to 3.9.4.

  [ tony mancill ]
  * Acknowledge NMU:  Thank you to Alberto Fernández Martínez.
    - Fix CVE-2012-5784 (Closes: #692650)
  * Update d/copyright to add lintian warnings.

 -- tony mancill <tmancill@debian.org>  Mon, 04 Feb 2013 22:14:27 -0800

axis (1.4-16.2) unstable; urgency=low

  * Non-maintainer upload.
  * Fix CVE-2012-5784 (Closes: #692650)
  * Fix CN extraction from DN of X500 principal.
  * Fix wildcard validation on ssl connections

 -- Alberto Fernández Martínez <infjaf@gmail.com>  Thu, 6 Dec 2012 14:28:00 +0100

axis (1.4-16.1) unstable; urgency=low

  * Non-maintainer upload.
  * Fix CVE-2012-5784 (Closes: #692650)

 -- Alberto Fernández Martínez <infjaf@gmail.com>  Wed, 5 Dec 2012 17:28:00 +0100

axis (1.4-16) unstable; urgency=low

  * Add missing dependency on libcommons-httpclient-java
  * Update Export-Package OSGi attribute in manifest
  * Add Require-Bundle OSGi attributes

 -- Jakub Adam <jakub.adam@ktknet.cz>  Mon, 31 Oct 2011 11:07:24 +0100

axis (1.4-15) unstable; urgency=low

  * Add OSGi metadata to jar manifests
  * Bump to Standards-Version 3.9.2
  * Updated the DEP-5 copyright to r202

 -- Jakub Adam <jakub.adam@ktknet.cz>  Thu, 27 Oct 2011 19:23:14 +0200

axis (1.4-14) unstable; urgency=low

  * Team upload.
  * Drop package libaxis-java-gcj.

 -- Torsten Werner <twerner@debian.org>  Thu, 08 Sep 2011 17:13:34 +0200

axis (1.4-13) unstable; urgency=low

  [ tony mancill ]
  * libaxis-java-gcj:  Remove incorrect libservlet2.4 depedency;
    the dependency on libaxis-java is sufficient.
    Thanks to Matthias Klose. (Closes: #597950)

  [ Damien Raude-Morvan ]
  * d/control: Bump Standards-Versions to 3.9.1 (no changes required).
  * d/control: Change short synopsis of packages.
  * Finaly upload to unstable.

 -- Damien Raude-Morvan <drazzib@debian.org>  Sun, 06 Mar 2011 19:08:04 +0100

axis (1.4-12) unstable; urgency=low

  [ Niels Thykier ]
  * Bumped Standards-Versions to 3.9.0 - no changes required.
  * Replaced B-D on default-jdk-builddep with gcj-native-helper
    and default-jdk.

  [ Damien Raude-Morvan ]
  * Downgrade libaxis-java-gcj from Recommends to Suggest (Closes: #582151).
  * Remove Depends on JRE since Axis is a library.

 -- Damien Raude-Morvan <drazzib@debian.org>  Thu, 08 Jul 2010 00:06:06 +0200

axis (1.4-11) unstable; urgency=low

  * Merge changes from Ubuntu:
    - debian/control, debian/rules: (Build-)Depend on libservlet2.5-java
      instead of libservlet2.4-java (LP: #534913)
  * Remove Stephan and Vladimír from Uploaders list.

 -- Torsten Werner <twerner@debian.org>  Sun, 09 May 2010 02:53:34 +0200

axis (1.4-10) unstable; urgency=low

  * Add symlinks for old JAR names to fix some FTBFS
    (Closes: #575041):
    - saaj.jar -> axis-saaj.jar
    - jaxrpc.jar -> axis-jaxrpc.jar
  * Javadoc:
    - Install Javadoc to /usr/share/doc/libaxis-java/api/
    - Register Javadoc with doc-base
    - d/patches/javadoc.diff and d/rules: Fix javadoc call
      to only use javadoc and no gjdoc (which fail with
      UnmappableCharacterException) and force 1.3 source format.
  * Fix short description of libaxis-java-doc to contains "documentation"
  * Rework d/copyright to use DEP5 format

 -- Damien Raude-Morvan <drazzib@debian.org>  Thu, 25 Mar 2010 23:45:41 +0100

axis (1.4-9) unstable; urgency=low

  * debian/rules: Fix FTBFS when doing arch build:
    - overrive install/libaxis-java for mh_installjar calls
    (instead of binary-post-install)

 -- Damien Raude-Morvan <drazzib@debian.org>  Sat, 20 Mar 2010 23:46:28 +0100

axis (1.4-8) unstable; urgency=low

  * Add Maven support:
    - debian/control: Build-Depends on maven-repo-helper
    - Add pom's files to debian/poms/
    - debian/rules: Use mh_installpoms and mh_installjar
  * Update Standards-Version: 3.8.4
    - debian/rules: Add recommended get-orig-source target
  * Bump to debhelper >= 7
  * Use 3.0 (quilt) source format:
    - debian/source/format: Set 3.0 (quilt)
    - debian/control: Remove quilt
    - debian/rules: Remove simpl-patchsys.mk
    - Refresh all debian/patches/*
  * Add DEP-3 headers to all patches

 -- Damien Raude-Morvan <drazzib@debian.org>  Sat, 20 Mar 2010 23:00:50 +0100

axis (1.4-7) unstable; urgency=low

  * Change Build-Depends: ant1.7-optional because gij is failing with ant 1.8.

 -- Torsten Werner <twerner@debian.org>  Sat, 27 Feb 2010 18:52:14 +0100

axis (1.4-6ubuntu1) lucid; urgency=low

  * debian/control, debian/rules: (Build-)Depend on libservlet2.5-java instead
    of libservlet2.4-java (LP: #534913)
  * debian/rules: Drop extra JAVA_HOME entry, build with default-jdk

 -- Thierry Carrez <thierry.carrez@ubuntu.com>  Tue, 09 Mar 2010 09:39:09 +0100

axis (1.4-6) unstable; urgency=low

  [ Matthias Klose ]
  * axis: Depend on default-jre-headless.
  * Build using java-gcj (axis is not 1.6 source compatible).

  [ Torsten Werner ]
  * Add patch for gcj-4.4: do not build function clearCache() which is not
    used anyway. (Closes: #531995)
  * Add myself to Uploaders.
  * Do no longer quote the full text of the Apache license.
  * Fix lintian warnings.
  * Move package to Section: java.
  * Update Standards-Version: 3.8.2 (no changes).
  * Add missing Depends: ${misc:Depends}.

 -- Torsten Werner <twerner@debian.org>  Fri, 24 Jul 2009 18:38:59 +0200

axis (1.4-5) unstable; urgency=low

  * Added missing packages to Depends of libaxis-java.
    Closes: #432582, #432582
  * Build-Depend on default-jdk-builddep instead of java-gcj-compat-dev.
    Closes: #477846
  * Cleaned up debian/copyright.
  * Added watch file.
  * Added Homepage, Vcs-Svn and Vcs-Browser fields.
  * Updated Standards-Version to 3.7.3.

 -- Michael Koch <konqueror@gmx.de>  Sat, 26 Apr 2008 22:49:29 +0200

axis (1.4-3) unstable; urgency=low

  * Added xmlParserAPIs.jar and xercesImpl.jar to classpath.
    Closes: #432538.

 -- Michael Koch <konqueror@gmx.de>  Sat, 14 Jul 2007 21:10:45 +0200

axis (1.4-2) unstable; urgency=low

  * Upload to unstable.
  * Inlcude javadocs.

 -- Michael Koch <konqueror@gmx.de>  Fri, 20 Apr 2007 17:32:10 -0100

axis (1.4-1) experimental; urgency=low

  * Merged from Ubuntu.
  * Upload to experimental.

 -- Michael Koch <konqueror@gmx.de>  Sat,  3 Mar 2007 10:48:11 +0100

axis (1.4-0ubuntu5) feisty; urgency=low

  * Fix build failure for binary arch builds.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 28 Feb 2007 17:10:36 +0100

axis (1.4-0ubuntu4) feisty; urgency=low

  * Recommend ant, instead of depending on it.
  * Install axis-ant.jar into usr/share/ant/lib.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 28 Feb 2007 12:22:49 +0100

axis (1.4-0ubuntu3) feisty; urgency=low

  * Build a libaxis-java-gcj package.
  * Set Ubuntu maintainer address.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 28 Feb 2007 01:06:05 +0100

axis (1.4-0ubuntu2) feisty; urgency=low

  * Added axis-ant.jar to the binary package

 -- Vladimír Lapáček <vladimir.lapacek@gmail.com>  Sat, 20 Jan 2007 11:09:48 +0100

axis (1.4-0ubuntu1) edgy; urgency=low

  * New upstream release.

 -- Vladimír Lapáček <vladimir.lapacek@gmail.com>  Wed,  6 Sep 2006 22:31:39 +0200

axis (1.2.1-1) unstable; urgency=low

  * Initial version based of the work of the Fedora packagers.

 -- Stephan Michels <stephan@apache.org>  Mon,  9 Jan 2006 11:40:09 +0100

