python-tornado (4.2.1-1ubuntu3.1+esm3) xenial-security; urgency=medium

  * SECURITY UPDATE: Denial of service when parsing large multipart bodies.
    - debian/patches/CVE-2026-31958.patch: Add limit of 100 parts and enforce
      checks in tornado/httputil.py. Add tests in
      tornado/test/httputil_test.py.
    - CVE-2026-31958
  * SECURITY UPDATE: Cookie attribute injection.
    - debian/patches/CVE-2026-35536-pre1.patch: Add set_cookie arguments and
      change from kwargs in tornado/web.py.
    - debian/patches/CVE-2026-35536.patch: Raise CookieError on invalid
      characters in tornado/web.py. Add tests in tornado/test/web_test.py.
    - CVE-2026-35536

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Tue, 21 Apr 2026 17:02:00 -0230

python-tornado (4.2.1-1ubuntu3.1+esm2) xenial-security; urgency=medium

  * SECURITY UPDATE: Denial of service due to malicious HTTP requests with
    repeated header names.
    - debian/patches/CVE-2025-67725-pre1.patch: Refactor dict in
      tornado/httputil.py. Add tests in tornado/test/httputil_test.py.
    - debian/patches/CVE-2025-67725.patch: Replace self._dict with
      self._combined_cache in tornado/httputil.py. Add tests in
      tornado/test/httputil_test.py.
    - debian/patches/CVE-2025-67725-post1.patch: Fix in-operator being case
      sensitive due to last patch changes in tornado/httputil.py. Add tests in
      tornado/test/httputil_test.py.
    - CVE-2025-67725
  * SECURITY UPDATE: Denial of service due to inefficient parsing of HTTP
    header values.
    - debian/patches/CVE-2025-67726.patch: Change _parseparam logic in
      tornado/httputil.py. Add tests in tornado/test/httputil_test.py.
    - CVE-2025-67726

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Thu, 08 Jan 2026 11:29:16 -0330

python-tornado (4.2.1-1ubuntu3.1+esm1) xenial-security; urgency=medium

  * SECURITY UPDATE: Open redirect vulnerability
   - debian/patches/CVE-2023-28370.patch: fix an open
     redirect in StaticFileHandler in tornado/web.py.
   - CVE-2023-28370

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 05 Jun 2023 11:18:24 -0300

python-tornado (4.2.1-1ubuntu3.1) xenial; urgency=low

  * d/p/0001-lp1903733-read-queue-of-1-message.patch (LP: #1903733)
    - fixes potential oom error with python-tornado client websocket
  * d/p/0002-lp1903733-Remove-unused-import.patch
    - code clean up 
  * d/control: update-maintainer

 -- Heather Lemon <heather.lemon@canonical.com>  Tue, 12 Jan 2021 21:32:45 +0000

python-tornado (4.2.1-1ubuntu3) xenial; urgency=medium

  * No-change rebuild to drop python3.4 support.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 18 Jan 2016 20:57:20 +0000

python-tornado (4.2.1-1ubuntu2) wily; urgency=medium

  * debian/patches/pymysql-replacement.patch: Use pymysql as drop in
    replacement for MySQLdb.

 -- Corey Bryant <corey.bryant@canonical.com>  Tue, 25 Aug 2015 10:29:28 -0400

python-tornado (4.2.1-1ubuntu1) wily; urgency=medium

  * debian/control: Drop python-mysqldb in favor of python-pymysql.

 -- Corey Bryant <corey.bryant@canonical.com>  Mon, 24 Aug 2015 12:48:35 -0400

python-tornado (4.2.1-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
  * debian/patches/python35-compat.patch: Python 3.5 compatibility fixes
    pulled from upstream.
  * debian/tests/control: Remove an obsolete comment.

 -- Barry Warsaw <barry@debian.org>  Tue, 18 Aug 2015 16:04:34 -0400

python-tornado (4.2.0-1) unstable; urgency=medium

  * Update to latest upstream (Closes: #779035)
  * Remove patches/certs-path.patch and ignore-ca-certificates.patch
    (now useless).
  * Refresh all other patches.
  * Add patches/without-certifi.patch so we directly look where we
    know the certs are.
  * Push standards-version up.
  * Add ca-certificates as a build-dep so tests pass.
  * Add myself as uploaders.

 -- Julien Puydt <julien.puydt@laposte.net>  Mon, 22 Jun 2015 11:24:38 +0200

python-tornado (3.2.2-1.1) unstable; urgency=medium

  * Non-Maintainer Upload.
  * patches/sockopt.patch: New patch to ignore ENOPROTOOPT errors from
    SO_REUSEADDR or SO_ERROR on AF_UNIX sockets, for systems which do not
    implement them there. Thanks Svante Signell for the patch. (Closes: #748903)

 -- Samuel Thibault <sthibault@debian.org>  Sat, 25 Oct 2014 21:14:45 +0200

python-tornado (3.2.2-1) unstable; urgency=medium

  * New upstream release
    - update watchfile to new location
  * skip-timing-tests.patch:
    skip tests that need fast machines (Closes: #751343)

 -- Julian Taylor <jtaylor.debian@googlemail.com>  Mon, 19 May 2014 21:42:13 +0200

python-tornado (3.2.0-1) unstable; urgency=medium

  * New upstream release
    - now arch: any package with binary extension for faster websockets

 -- Julian Taylor <jtaylor.debian@googlemail.com>  Sun, 23 Feb 2014 20:16:37 +0100

python-tornado (3.1.1-1) unstable; urgency=low

  * New upstream release
    - fixes localhost binding on disabled network (Closes: #711806)
  * drop upstream applied random-port.patch and CVE-2013-2099.patch
  * bump standard to 3.9.5 no changes required

 -- Julian Taylor <jtaylor.debian@googlemail.com>  Sun, 03 Nov 2013 18:48:51 +0100

python-tornado (2.4.1-3) unstable; urgency=low

  * Team upload.

  [ Jakub Wilk ]
  * Run tests only if DEB_BUILD_OPTIONS=nocheck is not set.

  [ Andrew Starr-Bochicchio ]
  * Backport fix for CVE 2013-2009. Avoid allowing multiple
    wildcards in a single SSL cert hostname segment (Closes: #709069).

 -- Andrew Starr-Bochicchio <asb@debian.org>  Fri, 04 Oct 2013 19:18:05 -0400

python-tornado (2.4.1-2) unstable; urgency=low

  [ Julian Taylor ]
  * upload to unstable
  * debian/rules: replace PWD with CURDIR

  [ Jakub Wilk ]
  * Use canonical URIs for Vcs-* fields.

 -- Julian Taylor <jtaylor.debian@googlemail.com>  Thu, 09 May 2013 20:08:11 +0200

python-tornado (2.4.1-1) experimental; urgency=low

  * New upstream release (Closes: #698566)
  * run python2 test during build (Closes: #663928)
  * add autopkgtests
  * ignoreuserwarning.patch:
    disable warning in test to allow testing with the package already installed
  * bump standards to 3.9.4, no changes required
  * random-port.patch: get a random free port for tests
  * don't compress example python files

 -- Julian Taylor <jtaylor.debian@googlemail.com>  Wed, 23 Jan 2013 20:26:46 +0100

python-tornado (2.3-2) unstable; urgency=low

  * debian/control
    - Replaced the python3.2 in the Depends field of python3-tornado
      by $(python3:Depends)
  * Renamed python-tornado.examples to examples
  * Removed python3-tornado.examples

 -- Carl Chenet <chaica@debian.org>  Sun, 10 Jun 2012 01:26:50 +0200

python-tornado (2.3-1) unstable; urgency=low

  [ Julian Taylor ]
  * Team upload
  * new upstream release
    - change debian/watch to download section instead of tag tarballs
      tag tarball contain lots of unnecessary website and test data
    - drop upstream applied CVE-2012-2374.patch
    - refresh patches
    - closes LP: #998615
  [ Carl Chenet]
  * debian/control
    - Replaced chaica@ohmytux.com by chaica@debian.org
    - Replace (python3:Depends) in python3-tornado Depends field
      because of https://github.com/facebook/tornado/issues/450
    - Modified the short description of python3-tornado package
  * Renamed examples to python-tornado.examples
  * Added python3-tornado.examples

 -- Carl Chenet <chaica@debian.org>  Sun, 10 Jun 2012 00:12:24 +0200

python-tornado (2.1.0-3) unstable; urgency=high

  [ Julian Taylor ]
  * Team upload
  * bump X-Python-Version to >= 2.6
    lower versions require arch any for custom epoll extension
  * move to Section: web (Closes: #665854)
    - override lintian wrong-section-according-to-package-name
  * CVE-2012-2374.patch adopted from upstream's GIT (Closes: #673987)

 -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 22 May 2012 19:11:51 -0400

python-tornado (2.1.0-2) unstable; urgency=low

  [ Thomas Kluyver ]
  * Package for Python 3 (Closes: #653643)

  [ Julian Taylor ]
  * make packages arch all
  * debian/control
    - wrap-and-sort fields
  * remove unnecessary Dependencies and Breaks
  * convert copyright to dep5
  * bump standard to 3.9.3 (no changes)

 -- Yaroslav Halchenko <debian@onerussian.com>  Tue, 13 Mar 2012 18:08:33 -0400

python-tornado (2.1.0-1) unstable; urgency=low

  * Team upload
  * New upstream release (Closes: #636602)
  * Refreshed patches
  * Updated debian/copyright
  * Added myself to uploaders to have bugs closed with uploads

 -- Yaroslav Halchenko <debian@onerussian.com>  Wed, 21 Sep 2011 19:58:11 -0400

python-tornado (1.2.1-1) unstable; urgency=low

  * New upstream release
  * debian/control
    - Bump Standards-Version to 3.9.2

 -- Carl Chenet <chaica@ohmytux.com>  Mon, 09 May 2011 16:56:04 +0200

python-tornado (1.2.0-1) unstable; urgency=low

  * New upstream release.
  * Added debian/examples
  * Added patch to ignore ca-certificates.crt from sources
  * Added patch to look for ca-certificates.crt at the right place
  * debian/copyright
    - Added copyrights and license for some files
    - some files no more in the upstream sources
  * debian/control
    - Removed python-support
    - Replaced XS-Python-Version by X-Python-Version
    - Added Breaks: ${python:Breaks}
    - Added Recommends: python (>= 2.6) | python-multiprocessing
    - Added Depends: ca-certificates
  * debian/rules
    - Replaced dh $@ by dh $@ --with python2
  * debian/watch
    - fixed the path

 -- Carl Chenet <chaica@ohmytux.com>  Tue, 01 Mar 2011 02:38:06 +0100

python-tornado (1.0.1-1) unstable; urgency=low

  * Team upload
  * New upstream release
  * Standards-Version bumped to 3.9.1 (no changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Sun, 22 Aug 2010 15:14:57 +0200

python-tornado (0.2-1) unstable; urgency=low

  * Initial release. (Closes: #551520)

 -- Carl Chenet <chaica@ohmytux.com>  Sat, 20 Mar 2010 17:38:45 +0100
