java-packages/tomcat11
SHA256
8
0
Fork 2
forked from pool/tomcat11
Code Pull Requests Activity
Files
main
tomcat11/tomcat11.changes

346 lines
18 KiB
Plaintext
Raw Permalink Blame History

-------------------------------------------------------------------
Tue Nov 18 18:41:24 UTC 2025 - Michele Bussolotto <michele.bussolotto@suse.com>
- make catalina.sh %config(noreplace) (bsc#1253460)
-------------------------------------------------------------------
Thu Nov 6 16:11:41 UTC 2025 - Ricardo Mestre <ricardo.mestre@suse.com>
- Update to Tomcat 11.0.13
* Fixed CVEs:
+ CVE-2025-55752: directory traversal via rewrite with possible RCE if PUT
is enabled (bsc#1252753)
+ CVE-2025-55754: Improper Neutralization of Escape, Meta, or Control
Sequences vulnerability in Apache Tomcat (bsc#1252905)
+ CVE-2025-61795: temporary copies during the processing of multipart
upload can lead to a denial of service (bsc#1252756)
* Catalina
+ Add: Add CIDR support for the configuration of internal and trusted
proxies for the RemoteIpFilter and RemoteIpValve. Configuration via
regular expression has been deprecated and will be removed in Tomcat 12.
(markt)
+ Fix: Log warnings when the SSO configuration does not comply with the
documentation. (remm)
+ Update: Deprecate the RemoteAddrFilter and RemoteAddValve in favour of the
RemoteCIDRFilter and RemoteCIDRValve. (markt)
+ Fix: 69837: Fix corruption of the class path generated by the Loader when
running on Windows. (markt)
+ Fix: Reject requests that map to invalid Windows file names earlier.
(markt)
+ Fix: 69839: Ensure that changes to session IDs (typically after
authentication) are promulgated to the SSO Valve to ensure that SSO
entries are fully clean-up on session expiration. Patch provided by Kim
Johan Andersson. (markt)
+ Fix: Fix a race condition in the creation of the storage location for the
FileStore. (markt)
+ Update: Change the digest used to calculate strong ETags (if enabled) for
the default Servlet from SHA-1 to SHA-256 to align with the recommendation
in RFC 9110 that hash functions used to generate strong ETags should be
collision resistant. (markt)
+ Fix: HTTP methods are case-sensitive so always use case sensitive
comparisons when comparing HTTP methods. (markt)
+ Fix: 69814: Ensure that HttpSession.isNew() returns false once the client
has joined the session. (markt)
+ Fix: Further performance improvements for ParameterMap. (jengebr/markt)
+ Code: Refactor access log time stamps to be based on the Instant request
processing starts. (markt)
+ Fix: Fix a case-sensitivity issue in the trailer header allow list.
(markt)
+ Fix: Be proactive in cleaning up temporary files after a failed multi-part
upload rather than waiting for GC to do it. (markt)
+ Code: Remove a number of unnecessary packages from the
catalina-deployer.jar. (markt)
+ Fix: 69781: Fix concurrent access issues in the session FileStore
implementation that were causing lost sessions when the store was used
with the PersistentValve. Based on pull request #882 by Aaron Ogburn.
(markt)
+ Code: Refactor WebResource locking to use the new
KeyedReentrantReadWriteLock. (markt)
+ Fix: Fix handling of QSA and QSD flags in RewriteValve. (markt)
* Cluster
+ Fix: Prevent the channel configuration (sender, receiver, membership
service) from being changed unless the channel is fully stopped. (markt)
+ Fix: Handle spurious wake-ups during leader election for
NonBlockingCoordinator. (markt)
+ Fix: Handle spurious wake-ups during sending of messages by RpcChannel.
(markt)
* Coyote
+ Fix: 69836: Incorrect processing of partitioned setting when generating
session cookie. Patch submitted by Marc Pynaert. (remm)
+ Fix: 69848: Fix copy/paste errors in 11.0.12 that meant DELETE requests
received via the AJP connector were processed as OPTIONS requests and
PROPFIND requests were processed as TRACE. (markt)
+ Update: Add specific certificate selection code for TLS 1.3 supporting
post quantum cryptography. Certificates defined with type MLDSA will be
selected depending on the TLS client hello. (remm)
+ Update: Add groups attribute on SSLHostConfig allowing to restrict which
groups can be enabled on the SSL engine. (remm)
+ Add: Optimize the conversion of HTTP method from byte form to String form.
(markt)
+ Fix: Store HTTP request headers using the original case for the header
name rather than forcing it to lower case. (markt)
+ Fix: 69762: Additional overflow fix for HPACK decoding of integers. Pull
request #880 by Chenjp. (markt)
+ Fix: Ensure keys are handed out to OpenSSL even if PEMFile fails to
process it, with appropriate logging. (remm)
+ Fix: Add new ML-DSA key algorithm to PEMFile and improve reporting when
reading a key fails. (remm)
+ Fix: Fix possible early timeouts for network operations caused by a
spurious wake-up of a waiting thread. Found by Coverity Scan. (markt)
* Web applications
+ Fix: Documentation. Clarify the purpose of the maxPostSize attribute of
the Connector element. (markt)
+ Fix: Avoid NPE in manager webapp displaying certificate information.
(remm)
* Websocket
+ Fix: 69845: When using permessage-deflate with Java 25 onwards, handle the
underlying Inflater and/or Deflater throwing IllegalStateException when
closed rather than NullPointerException as they do in Java 24 and earlier.
(markt)
* Other
+ Fix: 69847: Remove remaining references to the
org.apache.tomcat.util.codec.binary package which has been deleted.
(markt)
+ Update: Update Byte Buddy to 1.17.7. (markt)
+ Update: Update Checkstyle to 11.1.0. (markt)
+ Update: Update SpotBugs to 4.9.6. (markt)
+ Update: Update Jsign to 7.2. (markt)
+ Add: Improvements to Russian translations provided by usmazat. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations provided by tak7iji. (markt)
+ Update: Minor refactoring in JULI loggers. Patch provided by minjund.
(schultz)
+ Code: Review logging and include the full stack trace and exception
message by default rather then just the exception message when logging an
error or warning in response to an exception. (markt)
+ Add: Add escaping to log formatters to align with JSON formatter. (markt)
+ Update: Update Checkstyle to 11.0.0. (markt)
-------------------------------------------------------------------
Wed Oct 1 12:19:04 UTC 2025 - Fridrich Strba <fstrba@suse.com>
- Do not use update-alternatives
-------------------------------------------------------------------
Mon Aug 25 13:38:13 UTC 2025 - Michele Bussolotto <michele.bussolotto@suse.com>
- Update to Tomcat 11.0.10
* Fixed CVEs:
+ CVE-2025-48989: Update the HTTP/2 overhead documentation (bsc#1243895)
* Catalina
+ Fix: Fix bloom filter population for archive indexing when using a
packed WAR containing one or more JAR files. (markt)
* Coyote
+ Fix: 69748: Add missing call to set keep-alive timeout when using
HTTP/1.1 following an async request, which was present for AJP.
(remm/markt)
+ Fix: 69762: Fix possible overflow during HPACK decoding of integers.
Note that the maximum permitted value of an HPACK decoded integer is
Integer.MAX_VALUE. (markt)
+ Fix: Update the HTTP/2 overhead documentation - particularly the code
comments - to reflect the deprecation of the PRIORITY frame and
clarify that a stream reset always triggers an overhead increase.
(markt)
* Cluster
+ Update: Add enableStatistics configuration attribute for the
DeltaManager, defaulting to true. (remm)
* WebSocket
+ Fix: Align the WebSocket extension handling for WebSocket client
connections with WebSocket server connections. The WebSocket client
now only includes an extension requested by an endpoint in the
opening handshake if the WebSocket client supports that extension.
(markt)
* Web applications
+ Fix: Manager and Host Manager. Provide the Manager and Host Manager
web applications with a dedicated favicon file rather than using the
one from the ROOT web application which might not be present or may
represent something entirely different. Pull requests #876 and #878
by Simon Arame.
* Other
+ Update: Update Checkstyle to 10.26.1. (markt)
+ Add: Improvements to French translations. (remm)
+ Add: Improvements to Japanese translations by tak7iji. (markt)
-------------------------------------------------------------------
Wed Aug 6 13:07:07 UTC 2025 - Michele Bussolotto <michele.bussolotto@suse.com>
- Update to Tomcat 11.0.9
- adapt tomcat-jdt.patch
* Fixed CVEs:
+ CVE-2025-52520: Align size tracking for multipart requests with
FileUpload's use of long. (bsc#1246388)
+ CVE-2025-53506: Apply the initial HTTP/2 connection limits earlier.
(bsc#1246318)
* Catalina
+ Fix: Ensure application configured welcome files override the defaults
when configuring an embedded web application programmatically. (markt)
+ Update: Optimize Request#getCharsetHolder to avoid repeated parsing when
charset is null. Patch provided by morning-gu. (schultz)
+ Fix: Allow the default servlet to set the content length when the content
length is known, no content has been written and a Writer is being used.
(markt)
+ Fix: 69717: Correct a regression in the fix for CVE-2025-49125 that
prevented access to PreResources and PostResources when mounted below the
web application root with a path that was terminated with a file
separator. (remm/markt)
+ Fix: 69731: Fix an issue that meant that the value of maxParameterCount
applied was smaller than intended for multipart uploads with non-file
parts when the parts were processed before query string parameters.
(markt)
+ Fix: Align size tracking for multipart requests with FileUpload's use of
long. (schultz)
* Coyote
+ Fix: 69710: Increase the default for maxPartCount from 10 to 50. Update
the documentation to provide more details on the memory requirements to
support multi-part uploads while avoiding a denial of service risk.
(markt)
+ Fix: 69713: Correctly handle an HTTP/2 data frame that includes padding
when the headers include a content-length. (remm/markt)
+ Fix: Correctly collect statistics for HTTP/2 requests and avoid counting
one request multiple times. Based on pull request #868 by qingdaoheze.
(markt)
+ Fix: Fix JMX value for keepAliveCount on the endpoint. Also add the value
of useVirtualThreads in JMX. (remm)
+ Fix: 69728: Remove incorrect warning when HTTP/2 is used with optional
certificate verification and improve the warnings when a web application
tries to use CLIENT-CERT with either HTTP/2 or a JSSE implementation of
TLS 1.3. (markt)
+ Fix: When setting the initial HTTP/2 connection limit, apply those limits
earlier. (markt)
* Jasper
+ Code: Remove IMPL_OBJ_START from EL grammar for IDENTIFIER. (markt)
+ Code: Remove the INSTANCEOF and FUNCTIONSUFFIX definitions from the EL
grammar as both are unused. (markt)
* Web applications
+ Add: Documentation. Provide more explicit guidance regarding the security
considerations for enabling write access to the web application via
WebDAV, HTTP PUT requests or similar. (markt)
+ Add: Documentation. Add a section on reverse proxies to the security
considerations page. (markt)
* Other
+ Update: Update to the Eclipse JDT compiler 4.36. (markt)
+ Update: Update UnboundID to 7.0.3. (markt)
+ Update: Update Checkstyle to 10.25.1. (markt)
+ Update: Improvements to French translations. (remm)
+ Update: Improvements to Japanese translations provided by tak7iji. (markt)
-------------------------------------------------------------------
Tue Jun 24 10:09:09 UTC 2025 - Michele Bussolotto <michele.bussolotto@suse.com>
- Update to Tomcat 11.0.8
* Fixed CVEs:
+ CVE-2025-46701: refactor CGI servlet to access resources via
WebResources (bsc#1243815)
+ CVE-2025-48988: limits the total number of parts in a
multi-part request and limits the size of
the headers provided with each part (bsc#1244656)
+ CVE-2025-49125: Expand checks for webAppMount (bsc#1244649)
* Catalina
+ Add: Support for the java:module namespace which mirrors the
java:comp namespace.
+ Fix: 69690: Calling HttpServletRequest.getParameter() and related
methods for a request with content type multipart/form-data when
the mapped servlet does not have a @MultipartConfig or equivalent
should not trigger an exception. Note that calling getPart() or
getParts() is these circumstances will trigger an exception.
+ Add: Support parsing of multiple path parameters separated by ; in a
single URL segment. Based on pull request #860 by Chenjp.
+ Fix: 69699: Encode redirect URL used by the rewrite valve with the
session id if appropriate, and handle cross context with different
session configuration when using rewrite.
+ Add: #863: Support for comments at the end of lines in text rewrite
map files to align behaviour with Apache httpd. Pull request
provided by Chenjp.
+ Fix: 69706: Saved request serialization issue in FORM introduced
when allowing infinite session timeouts.
+ Fix: Expand the path checks for Pre-Resources and Post-Resources
mounted at a path within the web application.
+ Fix: Process possible path parameters rewrite production in the
rewrite valve.
+ Fix: 69588: Enable allowLinking to be set on PreResources,
JarResources and PostResources. If not set explicitly, the setting
will be inherited from the Resources.
+ Add: 69633: Support for Filters using context root mappings.
+ Fix: 69643: Optimize directory listing for large amount of files.
Patch submitted by Loic de l'Eprevier.
+ Fix: #843: Off by one validation logic for partial PUT ranges and
associated test case. Submitted by Chenjp.
+ Refactor: GCI servlet to access resources via the WebResource API.
+ Fix: 69662: Report name in exception message when a naming lookup
failure occurs. Based on code submitted by Donald Smith.
+ Fix: Ensure that the FORM authentication attribute
authenticationSessionTimeout works correctly when sessions have an
infinite timeout when authentication starts.
+ Add: Provide a content type based on file extension when web
application resources are accessed via a URL.
* Coyote
+ Refactor: #861: TaskQueue to use the new interface RetryableQueue
which enables better integration of custom Executors which provide
their own BlockingQueue implementation. Pull request provided by
Paulo Almeida.
+ Add: Finer grained control of multi-part request processing via two
new attributes on the Connector element. maxPartCount limits the
total number of parts in a multi-part request and maxPartHeaderSize
limits the size of the headers provided with each part. Add support
for these new attributes to the ParameterLimitValve.
* Jasper
+ Fix: 69696: Mark the JSP wrapper for reload after a failed
compilation.
+ Fix: 69635: Add support to jakarta.el.ImportHandler for resolving
inner classes.
+ Add: #842: Support for optimized execution of c:set and c:remove
tags, when activated via JSP servlet param
useNonstandardTagOptimizations.
+ Fix: An edge case compilation bug for JSP and tag files on case
insensitive file systems that was exposed by the test case for
69635.
* Web applications
+ Fix: 69694: Improve error reporting of deployment tasks done using
the manager webapp when a copy operation fails.
+ Add: 68876: Documentation. Update the UML diagrams for server
start-up, request processing and authentication using PlantUML and
include the source files for each diagram.
* Other
+ Add: Thread name to webappClassLoader.stackTraceRequestThread
message. Patch provided by Felix Zhang.
+ Update: Tomcat Native to 2.0.9.
+ Update: The internal fork of Apache Commons FileUpload to 1.6.0-RC1
(2025-06-05).
+ Update: EasyMock to 5.6.0.
+ Update: Checkstyle to 10.25.0.
+ Fix: Use the full path when the installer for Windows sets calls
icacls.exe to set file permissions.
+ Update: Improvements to Japanese translations provided by tak7iji.
+ Update: Jacoco to 0.8.13.
+ Code: Explicitly set the locale to be used for Javadoc. For
official releases, this locale will be English (US) to support
reproducible builds.
+ Update: Byte Buddy to 1.17.5.
+ Update: Checkstyle to 10.23.1.
+ Update: File extension to media type mappings to align with the
current list used by the Apache Web Server (httpd).
+ Update: Improvements to French translations.
+ Update: Improvements to Japanese translations provided by tak7iji.
-------------------------------------------------------------------
Tue Jun 10 13:09:57 UTC 2025 - Michele Bussolotto <michele.bussolotto@suse.com>
- Hardening permissions (bsc#1242722)
-------------------------------------------------------------------
Fri May 9 07:06:53 UTC 2025 - Fridrich Strba <fstrba@suse.com>
- Do not require standalone versions of apis that tomcat itself
carries
- Do not version dependencies
-------------------------------------------------------------------
Fri May 2 14:56:19 UTC 2025 - Fridrich Strba <fstrba@suse.com>
- Make conflicts and provides more generic
-------------------------------------------------------------------
Mon Apr 28 10:21:33 UTC 2025 - Ricardo Mestre <ricardo.mestre@suse.com>
- Initial packaging of tomcat11 11.0.6
View Git Blame Copy Permalink