apache-directory-api (2.1.9-1) unstable; urgency=medium

  * Team upload
  * New upstream version 2.1.9:
    - Fixes CVE-2026-35563:
    It was identified that the LDAP client implementation in version
    2.1.7 does not verify if the server certificate matches the intended
    LDAP  hostname. While the underlying code validates the certificate
    chain  against a trusted authority, the absence of endpoint
    identification  allows a valid certificate issued for an entirely
    unrelated host to be  improperly accepted. This oversight leaves the
    connection highly  vulnerable to server impersonation and complete
    connection compromise.   The  root cause of this vulnerability lies
    in the incomplete TLS server  identity verification within the LDAP
    client implementation.     The attacker requires MITM capability on
    the network to exploit this vulnerability. This attacker must be
    able to present a certificate trusted by the client's configured
    trust store.     The hostname verification has been enforced in the
    new version of the LDAP API.
    (Closes: #1139171)
    - Fixes CVE-2026-102731:
    Memory allocation with excessive size value vulnerability in Apache
    Directory LDAP API.    A malicious peer (or a MITM) can send a small
    BER-encoded response causing a large memory allocation before any
    data is received. This can lead to an OutOfMemoryError and denial of
    service.    The client JVM OOMs (OutOfMemoryError bypasses the
    DecoderException handlers) or pins the large allocation per
    connection while the attacker stalls.    A handful of connections
    exhausts any heap. The same bytes from an unauthenticated pre-bind
    client hit any embedding server that did not set MAX_PDU_SIZE_ATTR.
    - Fixes CVE-2026-103552:
    Stack Overflow vulnerability in Apache Directory LDAP API.    Before
    binding, a client can send a deeply nested search filter that
    overflows the stack in the server's decoder.
    - Fixes CVE-2026-103877:
    Deserialization of Untrusted Data vulnerability in Apache Directory
    LDAP API.    A rogue/compromised LDAP server (or pre-TLS MITM) can
    answer a client's loadSchema() subschema search with a schema object
    that contains a serialized Java class, allowing some potential RCE.
    - Fixes CVE-2026-103878:
    Cleartext transmission of sensitive information vulnerability in
    Apache Directory LDAP API.    A StartTLS extended operation started
    after a Search request has been sent can lead to receive data in
    plain text before the TLS Handshake has been completed.
    - Fixes CVE-2026-103880:
    Asymmetric Resource Consumption vulnerability in Apache Directory
    LDAP API.    Storing a password using the bcrypt algorithm with a
    high force like 30 in a LDAP server that supports this algorithm
    will cause the server CPU to  run for hours checking the
    credentials. A bounded cost should be enforced to avoid a server
    DOS.
    - Fixes CVE-2026-103885:
    Asymmetric Resource Consumption vulnerability in Apache Directory
    LDAP API.    A LDAP server using the LDAP API (like Apache DS) may
    consume 100% of a CPU core indefinitely when processing some badly
    crafted Telephone Numbers.
    (Closes: #1149877)
  * Raising Standards version to 4.7.4:
    - Removing Priority: optional, which is now defaults
  * Removing unneeded versioned Build-Dependencies
  * Updating Build-Dependencies and the Maven rules
  * Adding a versioned Build-Dependency on mina2
  * Switching to debhelper-compat 14, removing misc: substvar
  * Shipping NoVerificationTrustManager so that it can be used in
    apache-directory-server
  * Use secure URI in Homepage field.
  * Re-export upstream signing key without extra signatures.
  * Set upstream metadata fields: Bug-Database, Repository.

  [ Bastien Roucariès ]
  * Raising d/watch version to 5
  * Add salsa CI

 -- Pierre Gruet <pgt@debian.org>  Wed, 04 Nov 2026 15:38:38 +0100

apache-directory-api (2.1.2-2) unstable; urgency=medium

  * Ignore maven-surefire-report-plugin (Closes: #1086254)
  * Depend on commons-collections4 instead of commons-collections3
  * Depend on commons-lang3 instead of commons-lang
  * Standards-Version updated to 4.7.0

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 30 Oct 2024 09:43:37 +0100

apache-directory-api (2.1.2-1) unstable; urgency=medium

  * New upstream release
    - Refreshed the patch
    - Depend on libmina2-java (>= 2.2.1) (Closes: #1026726)
    - Depend on libcommons-pool2-java instead of libcommons-pool-java
    - New dependency on libcommons-text-java
  * Standards-Version updated to 4.6.1
  * Track and download the new releases from GitHub

 -- Emmanuel Bourg <ebourg@apache.org>  Mon, 26 Dec 2022 18:26:42 +0100

apache-directory-api (1.0.0-2) unstable; urgency=medium

  * Removed the dependency on libjaxp1.3-java
  * Standards-Version updated to 4.5.1
  * Switch to debhelper level 13
  * Use salsa.debian.org Vcs-* URLs

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 21 Jan 2021 16:53:13 +0100

apache-directory-api (1.0.0-1) unstable; urgency=medium

  * Team upload.
  * Watch official signed upstream release tarballs
  * New upstream release (1.0.0)
  * Use https in debian/watch
  * Remove 02-CVE-2015-3250.patch (fixed in M31)
  * Update for 1.0.0:
      * debian/libapache-directory-api-java.poms
      * debian/maven.ignoreRules
      * debian/maven.rules
  * Comment out ignore rules which can be ignored
  * Update debian/copyright
  * Install NOTICE with libapache-directory-api-java to comply with Apache-2.0
  * Bump debhelper compat from 9 to 11
  * Bump Standards-Version from 3.9.8 to 4.1.3 (no change required)
  * Remove unnecessary greater-than versioned dependency
  * Add mockito-core to maven.ignoreRules

 -- Christopher Hoskin <mans0954@debian.org>  Sat, 27 Jan 2018 09:07:25 +0000

apache-directory-api (1.0.0~M20-5) unstable; urgency=medium

  * Depend on libfindbugs-annotations-java instead of findbugs

 -- Emmanuel Bourg <ebourg@apache.org>  Fri, 19 Aug 2016 23:35:37 +0200

apache-directory-api (1.0.0~M20-4) unstable; urgency=medium

  * Added the missing build dependency on antlr (Closes: #828892)
  * Build with the DH sequencer instead of CDBS
  * Standards-Version updated to 3.9.8
  * Use a secure Vcs-Git URL

 -- Emmanuel Bourg <ebourg@apache.org>  Tue, 28 Jun 2016 22:31:34 +0200

apache-directory-api (1.0.0~M20-3) unstable; urgency=medium

  * Fixed CVE-2015-3250: Timing Attack vulnerability (Closes: #791957)

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 09 Jul 2015 23:07:02 +0200

apache-directory-api (1.0.0~M20-2) unstable; urgency=medium

  * Ignore the parent pom for the api-all artifact

 -- Emmanuel Bourg <ebourg@apache.org>  Wed, 01 Jul 2015 17:14:53 +0200

apache-directory-api (1.0.0~M20-1) unstable; urgency=medium

  * Initial release (Closes: #789679)

 -- Emmanuel Bourg <ebourg@apache.org>  Thu, 25 Jun 2015 00:13:11 +0200
