Navigation:
Browse pkgsrc
(this page) 2017-03-03 16:21:29 by Benny Siegert | Files touched by this commit (3) |  |
Log message:
Pullup ticket #5220 - requested by spz
www/apache-tomcat8: security fix
Revisions pulled up:
- www/apache-tomcat8/Makefile 1.9-1.10
- www/apache-tomcat8/PLIST 1.5-1.7
- www/apache-tomcat8/distinfo 1.10-1.11
---
Module Name: pkgsrc
Committed By: spz
Date: Sun Jan 1 17:26:13 UTC 2017
Modified Files:
pkgsrc/www/apache-tomcat8: Makefile PLIST distinfo
Log message:
update to current tomcat 8.0 train version, fixing CVE-2016-5388.
Changelog:
Tomcat 8.0.39 (violetagg)
Catalina
Fix: When creating a new Connector via JMX, ensure that both HTTP/1.1 and \
AJP/1.3 connectors can be created. (markt)
Fix: Include the Context name in the log message when an item cannot be \
added to the cache. (markt)
Fix: Exclude JAR files in /WEB-INF/lib from the static resource cache. (markt)
Fix: When calling getResourceAsStream() on a directory, ensure that null \
is returned. (markt)
Fix: 60161: Allow creating subcategories of the container logger, and use \
it for the rewrite valve. (remm)
Fix: Correctly test for control characters when reading the provided \
shutdown password. (markt)
Fix: When configuring the JMX remote listener, specify the allowed types \
for the credentials. (markt)
Coyote
Fix: Correct the HTTP header parser so that DEL is not treated as a valid \
token character. (markt)
Fix: 60319: When using an Executor, disconnect it from the Connector \
attributes maxThreads, minSpareThreads and threadPriority to enable the \
configuration settings to be consistently reported.
These Connector attributes will be reported as -1 when an Executor is in use. \
The values used by the executor may be set and obtained via the Executor. \
(markt)
Fix: If an I/O error occurs during async processing on a non-container \
thread, ensure that the onError() event is triggered. (markt)
Fix: Improve detection of I/O errors during async processing on \
non-container threads and trigger async error handling when they are detected. \
(markt)
Add: Add additional checks for valid characters to the HTTP request line \
parsing so invalid request lines are rejected sooner. (markt)
Web applications
Fix: Correct a typo in HTTP Connector How-To. Issue reported via \
comments.apache.org. (violetagg)
Fix: Fix default value of validationInterval attribute in jdbc-pool. (kfujino)
Fix: Correct a typo in CGI How-To. Issue reported via \
comments.apache.org. (violetagg)
Tribes
Fix: When the proxy node sends a backup retrieve message, ensure that \
using the channelSendOptions that has been set rather than the default \
channelSendOptions. (kfujino)
Other
Update: Update the ECJ compiler to version 4.5.1. (markt)
Fix: Remove classes from tomcat-util-scan.jar that are duplicates of \
those in tomcat-util.jar. (markt)
2016-10-10 Tomcat 8.0.38 (markt)
Catalina
Add: 59961: Add an option to the StandardJarScanner to control whether or \
not JAR Manifests are scanned for additional class path entries. (markt)
Fix: 60013: Refactor the previous fix to align the behaviour of the \
Rewrite Valve with mod_rewrite. As part of this, provide an implementation for \
the B and NE flags and improve the handling for
the QSA flag. Includes multiple test cases by Santhana Preethiand a patch by \
Tiago Oliveira. (markt)
Fix: 60087: Refactor the web resources handling to use the Tomcat \
specific war:file:... URL protocol to refer to WAR files and their contents \
rather than the standard jar:file:... form since some
components of the JRE, such as JAR verification, give unexpected results when \
the standard form is used. A side-effect of the refactoring is that when using \
packed WARs, it is now possible to
reference a WAR and/or specific JARs within a WAR in the security policy file \
used when running under a SecurityManager. (markt)
Fix: 60116: Fix a problem with the rewrite valve that caused back \
references evaluated in conditions to be forced to lower case when using the NC \
flag. (markt)
Fix: Ensure Digester.useContextClassLoader is considered in case the \
class loader is used. (violetagg)
Fix: 60117: Ensure that the name of LogLevel is localized when using \
OneLineFormatter. Patch provided by Tatsuya Bessho. (kfujino)
Fix: 60146: Improve performance for resource retrieval by making calls to \
WebResource.getInputStream() trigger caching if the resource is small enough. \
Patch provided by mohitchugh. (markt)
Add: 60151: Improve the exception error messages when a ResourceLink \
fails to specify the type, specifies an unknown type or specifies the wrong \
type. (markt)
Fix: 60167: Ignore empty lines in /etc/passwd files when using the \
PasswdUserDatabase. (markt)
Fix: 60170: Exclude the compressed test file index.html.br from RAT \
analysis. Patch provided by Gavin McDonald. (markt)
Fix: When starting web resources, ensure that class resources are only \
started once. (markt)
Fix: Improve the access checks for linked global resources to handle the \
case where the current class loader is a child of the web application class \
loader. (markt)
Fix: 60199: Log a warning if deserialization issues prevent a session \
attribute from being loaded. (markt)
Coyote
Fix: Correctly handle a call to AsyncContext.complete() from a \
non-container thread when non-blocking I/O is being used. (markt)
Add: Refactor the code that implements the requirement that a call to \
complete() or dispatch() made from a non-container thread before the container \
initiated thread that called startAsync()
completes must be delayed until the container initiated thread has completed. \
Rather than implementing this by blocking the non-container thread, extend the \
internal state machine to track this. This
removes the possibility that blocking the non-container thread could trigger \
a deadlock. (markt)
Fix: 60123: Avoid potential threading issues that could cause excessively \
large vales to be returned for the processing time of a current request. (markt)
Fix: 60174: Log instances of HeadersTooLargeException during request \
processing. (markt)
Jasper
Fix: 60101: Remove preloading of the class that was deleted. (violetagg)
Web applications
Add: Expand the documentation for the nested elements within a Resources \
element to clarify the behaviour of different configuration options with respect \
to the order in which resources are
searched. (markt)
Add: Add an example of using the classesToInitialize attribute of the \
JreMemoryLeakPreventionListener to the documentation web application. Based on a \
patch by Cris Berneburg. (markt)
Fix: 60192: Correct a typo in the status output of the Manager \
application. Patch provided by Radhakrishna Pemmasani. (markt)
jdbc-pool
Fix: Notify jmx when returning the connection that has been marked \
suspect. (kfujino)
Fix: Ensure that the POOL_EMPTY notification has been added to the jmx \
notification types. (kfujino)
Fix: 60099: Ensure that use all method arguments as a cache key when \
using StatementCache. (kfujino)
Fix: 60139: Correct Javadocs for PoolConfiguration.getValidationInterval \
and setValidationInterval. Reported by Phillip Webb. (kfujino)
Other
Fix: Update the download location for Objenesis. (violetagg)
Fix: 60164: Replace log4j-core*.jar with log4j-web*.jar since it is \
log4j-web*.jar that contains the ServletContainerInitializer. (markt)
Add: Add documentation to the bin/catalina.bat script to remind users \
that environment variables don't affect the configuration of Tomcat when run as \
a Windows Service. Based upon a documentation
patch by James H.H. Lampert. (schultz)
Update: Update the packaged version of the Tomcat Native Library to \
1.2.10 to pick up the latest Windows binaries built with OpenSSL 1.0.2j. (markt)
2016-09-05 Tomcat 8.0.37 (markt)
Catalina
Fix: 57705: Add debug logging for requests denied by the remote host and \
remote address valves and filters. Based on a patch by Graham Leggett. (markt)
Add: 59399: Add a new option to the Realm implementations that ship with \
Tomcat that allows the HTTP status code used for HTTP -> HTTPS redirects to \
be controlled per Realm. (markt)
Update: Change the default of the sessionCookiePathUsesTrailingSlash \
attribute of the Context element to false since the problems caused when a \
Servlet is mapped to /* are more significant than
the security risk of not enabling this option by default. (markt)
Fix: Do not attempt to start web resources during a web application's \
initialisation phase since the web application is not fully configured at that \
point and the web resources may not be
correctly configured. (markt)
Fix: 59708: Modify the LockOutRealm logic. Valid authentication attempts \
during the lock out period will no longer reset the lock out timer to zero. \
(markt)
Fix: Improve error handling around user code prior to calling \
InstanceManager.destroy() to ensure that the method is executed. (markt)
Fix: 59813: Ensure that circular relations of the Class-Path attribute \
from JAR manifests will be processed correctly. (violetagg)
Fix: Ensure that reading the singleThreadModel attribute of a \
StandardWrapper via JMX does not trigger initialisation of the associated \
servlet. With some frameworks this can trigger an
unexpected initialisation thread and if initilisation is not thread-safe the \
initialisation can then fail. (markt)
Fix: Compatibility with rewrite from httpd for non existing headers. (jfclere)
Fix: By default, treat paths used to obtain a request dispatcher as \
encoded. This behaviour can be changed per web application via the \
dispatchersUseEncodedPaths attribute of the Context. (markt)
Fix: 59839: Apply roleSearchAsUser to all nested searches in JNDIRealm. \
(fschumacher)
Fix: 59859: Fix resource leak in WebDAV servlet. Based on patch by Coty \
Sutherland. (fschumacher)
Add: Provide a mechanism that enables the container to check if a \
component (typically a web application) has been granted a given permission when \
running under a SecurityManager without the
current execution stack having to have passed through the component. Use this \
new mechanism to extend SecurityManager protection to the system property \
replacement feature of the digester. (markt)
Add: When retrieving an object via a ResourceLink, ensure that the object \
obtained is of the expected type. (markt)
Fix: 59824: Mark the RewriteValve as supporting async processing by \
default. (markt)
Fix: 59862: Allow nested jar files scanning to be filtered with the \
system property tomcat.util.scan.StandardJarScanFilter.jarsToSkip. Patch is \
provided by Terence Bandoian. (violetagg)
Fix: 59866: When scanning WEB-INF/classes for annotations, don't scan the \
contents of WEB-INF/classes/META-INF (if present) since classes will never be \
loaded from that location. (markt)
Fix: 59888: Correctly handle tabs and spaces in quoted version one \
cookies when using the Rfc6265CookieProcessor. (markt)
Fix: 59912: Fix an edge case in input stream handling where an \
IOException could be thrown when reading a POST body. (markt)
Fix: 59960: Fix Javadoc so it builds with Java 8. Patch by Coty \
Sutherland. (markt)
Fix: 59966: Do not start the web application if the error page \
configuration in web.xml is invalid. (markt)
Fix: Switch the CGI servlet to the standard logging mechanism and remove \
support for the debug attribute. (markt)
Fix: Changes to the allowLinking attribute of a StandardRoot instance now \
invalidate the cache if caching is enabled. (markt)
Add: Add a new initialisation parameter, envHttpHeaders, to the CGI \
Servlet to mitigate httpoxy (CVE-2016-5388) by default and to provide a \
mechanism that can be used to mitigate any future,
similar issues. (markt)
Add: When adding and removing ResourceLinks dynamically, ensure that the \
global resource is only visible via the ResourceLinkFactory when it is meant to \
be. (markt)
Fix: 60008: When processing CORs requests, treat any origin with a URI \
scheme of file as a valid origin. (markt)
Fix: Improve handling of exceptions during a Lifecycle events triggered \
by a state transition. The exception is now caught and the component is now \
placed into the FAILED state. (markt)
Fix: 60013: Fix encoding issues when using the RewriteValve with UTF-8 \
query strings or UTF-8 redirect URLs. (markt)
Fix: 60022: Improve handling when a WAR file and/or the associated \
exploded directory are symlinked into the appBase. (markt)
Fix: Fix a file descriptor leak when reading the global web.xml. (markt)
Fix: Consistently decode URL patterns provided via web.xml using the \
encoding of the web.xml file where specified or UTF-8 where no explicit encoding \
is specified. (markt)
Fix: Make timing attacks against the Realm implementations harder. (schultz)
Coyote
Fix: Improve error handling around user code prior to calling \
InstanceManager.destroy() to ensure that the method is executed. (markt)
Fix: Extend synchronization for NIO2 writes to avoid \
ConcurrentModificationException observed during testing. (markt)
Fix: 59904: Add a limit (default 200) for the number of cookies allowed \
per request. Based on a patch by gehui. (markt)
Fix: 59925: Correct regression in r1628368 and ensure that HTTP \
separators are handled as configured in the LegacyCookieProcessor. Patch \
provided by Kyohei Nakamura. (markt)
Fix: OpenSSL now disables 3DES by default so reflect this when using \
OpenSSL syntax to select ciphers. (markt)
Jasper
Fix: Improve error handling around user code prior to calling \
InstanceManager.destroy() to ensure that the method is executed. (markt)
Fix: Improve the error handling for custom tags to ensure that the tag is \
returned to the pool or released and destroyed once used. (markt)
Fix: 60032: Fix handling of method calls that use varargs within EL value \
expressions. (markt)
Fix: Ignore engineOptionsClass and scratchdir when running under a \
security manager. (markt)
Fix: Fixed StringIndexOutOfBoundsException. Based on a patch provided by \
wuwen via Github. (violetagg)
WebSocket
Fix: Improve error handling around user code prior to calling \
InstanceManager.destroy() to ensure that the method is executed. (markt)
Fix: 59908: Ensure that a reason phrase is included in the close message \
if a session is closed due to a timeout. (markt)
Web Applications
Fix: Do not log an additional case of IOExceptions in the error handler \
for the Drawboard WebSocket example when the root cause is the client \
disconnecting since the logs add no value. (markt)
Fix: 59642: Mention the localDataSource in the DataSourceRealm section of \
the Realm How-To. (markt)
Fix: Follow-up to the fix for 59399. Ensure that the new attribute \
transportGuaranteeRedirectStatus is documented for all Realms. Also document the \
NullRealm and when it is automatically created
for an Engine. (markt)
Fix: Fix the description of maxAge attribute in jdbc-pool doc. This \
attribute works both when a connection is returned and when a connection is \
borrowed. (kfujino)
Fix: 59774: Correct the prefix values in the documented examples for \
configuring the AccessLogValve. Patch provided by Mike Noordermeer. (markt)
Fix: 59868: Clarify the documentation for the Manager web application to \
make clearer that the host name and IP address in the server section are the \
primary host name and IP address. (markt)
Fix: MBeans Descriptors How-To is moved to mbeans-descriptors-howto.html. \
Patch provided by Radoslav Husar. (violetagg)
Fix: Update NIO Connector configuration documentation with an information \
about socket.directSslBuffer. (violetagg)
Fix: 60034: Correct a typo in the Manager How-To page of the \
documentation web application. (markt)
Tribes
Add: Add log message when the ping has timed-out. (kfujino)
Fix: If the ping message has been received at the \
AbstractReplicatedMap#leftOver method, ensure that notify the member is alive \
than ignore it. (kfujino)
jdbc-pool
Fix: Fix the duplicated connection release when connection verification \
failed. (kfujino)
Fix: Ensure that do not remove the abandoned connection that has been \
already released. (kfujino)
Fix: In order to avoid the unintended skip of PoolCleaner, remove the \
check code of the execution interval in the task that has been scheduled. \
(kfujino)
Fix: 59850: Ensure that the ResultSet is closed when enabling the \
StatementCache interceptor. (kfujino)
Fix: 59923: Reduce the default value of validationInterval in order to \
avoid the potential issue that continues to return an invalid connection after \
database restart. (kfujino)
Fix: Ensure that the ResultSet is returned as Proxy object when enabling \
the StatementDecoratorInterceptor. (kfujino)
Fix: 60043: Ensure that the suspectTimeout works without removing \
connection when the removeAbandoned is disabled. (kfujino)
Fix: Add log message of when returning the connection that has been \
marked suspect. (kfujino)
Fix: Correct Javadoc for ConnectionPool.suspect(). Based on a patch by \
Yahya Cahyadi. (markt)
Other
Update: 59276: Update optional Checkstyle library to 6.17. (kkolinko)
Add: Use the mirror network rather than the ASF master site to download \
the current ASF dependencies. (markt)
Update: Update the packaged version of the Tomcat Native Library to 1.2.8 \
to pick up the latest fixes and make 1.2.8 the minimum recommended version. \
(markt)
Fix: 59899: Update Tomcat's copy of the Java Persistence annotations to \
include the changes made in 2.1 / JavaEE 7. (markt)
Fix: Fixed typos in mbeans-descriptors.xml files. (violetagg)
Update: Update the internal fork of Commons BCEL to r1757132 to align \
with the BCEL 6 release. (markt)
Update: Update the internal fork of Commons DBCP2 to r1757164 to pick up \
a couple of bug fixes. (markt)
Update: Update the internal fork of Commons Codec to r1757174. Code \
formatting changes only. (markt)
Update: Update the internal fork of Commons FileUpload to afdedc9. This \
pulls in a fix to improve the performance with large multipart boundaries. \
(markt)
---
Module Name: pkgsrc
Committed By: spz
Date: Sat Feb 4 20:48:03 UTC 2017
Modified Files:
pkgsrc/www/apache-tomcat8: Makefile PLIST distinfo
Log message:
Update to Tomcat 8.0.41. Upstream changelog:
Tomcat 8.0.41 (violetagg)
Cluster
Add: Make the accessTimeout configurable in BackupManager. The \
accessTimeout is used as a timeout period for PING in replication map. (kfujino)
Web applications
Fix: Ensure the ASF logo image is displayed in host-manager. (violetagg)
not released Tomcat 8.0.40 (violetagg)
Catalina
Add: 53602: Add HTTP status code 451 (RFC 7725) to the list of HTTP \
status codes recognised by Tomcat. (markt)
Fix: 60446: Handle the case where the stored user credential uses a \
different key length than the length currently configured for the \
CredentialHandler. Based on a patch by Niklas Holm. (markt)
Fix: 60351: Delay creating META-INF/war-tracker file until after the WAR \
has been expanded to address the case where the Tomcat process terminates during \
the expansion. (markt)
Fix: Correctly handle the configClass attribute of a Host when embedding \
Tomcat. (markt)
Fix: 60379: Dispose of the GSS credential once it is no longer required. \
Patch provided by Michael Osipov. (markt)
Fix: 60380: Ensure that a call to HttpServletRequest#logout() triggers a \
call to TomcatPrincipal#logout(). Based on a patch by Michael Osipov. (markt)
Fix: 60387: Correct the javadoc for \
o.a.catalina.AccessLog.setRequestAttributesEnabled. The default value is \
different for the different implementations. (violetagg)
Code: 60393: Use consistent parameter naming in implementations of \
Realm#authenticate(GSSContext, boolean). (markt)
Fix: 60395: Log when an Authenticator passes an incomplete GSSContext to \
a Realm since it indicates a bug in the Authenticator. Patch provided by Michael \
Osipov. (markt)
Fix: Correctly generate URLs for resources located inside JARs that are \
themselves located inside a packed WAR file. (markt)
Fix: 60410: Ensure that multiple calls to JarInputStreamWrapper#close() \
do not incorrectly trigger the closure of the underlying JAR or WAR file. \
(markt)
Fix: 60411: Implement support in the RewriteValve for symbolic names to \
specify the redirect code to use when returning a redirect response to the user \
agent. Patch provided by Michael Osipov.
(markt)
Fix: 60413: In the RewriteValve write empty capture groups as the empty \
string rather than as "null" when generating the re-written URL. Based \
on a patch by Michael Osipov. (markt)
Update: Update the warnings that reference required options for running \
on Java 9 to use the latest syntax for those options. (markt)
Fix: 60513: Fix thread safety issue with RMI cleanup code. (remm)
Coyote
Fix: Ensure that the endpoint is able to unlock the acceptor thread \
during shutdown if the endpoint is configured to listen to any local address of \
a specific type such as 0.0.0.0 or ::. (markt)
Fix: Prevent read time out when the file is deleted while serving the \
response. The issue was observed only with APR Connector and sendfile enabled. \
(violetagg)
Fix: Improve the logic that selects an address to use to unlock the \
Acceptor to take account of platforms what do not listen on all local addresses \
when configured with an address of 0.0.0.0 or
::. (markt)
Fix: 60409: When unable to complete sendfile request, ensure the \
Processor will be added to the cache only once. (markt/violetagg)
Jasper
Fix: 60431: Improve handling of varargs in UEL expressions. Based on a \
patch by Ben Wolfe. (markt)
Fix: 60497: Restore previous tag reuse behavior following the use of \
try/finally. (remm)
Fix: Improve the error handling for simple tags to ensure that the tag is \
released and destroyed once used. (remm)
Fix: 60497: Follow up fix using a better variable name for the tag reuse \
flag. (remm)
Fix: Revert use of try/finally for simple tags. (remm)
Web applications
Fix: Correct a typo in Host Configuration Reference. Issue reported via \
comments.apache.org. (violetagg)
Fix: 60344: Add a note to BUILDING.txt regarding using the source bundle \
with the correct line endings. (markt)
Fix: 60412: Add information on the comment syntax for the RewriteValve \
configuration. (markt)
Fix: 60467: remove problematic characters from XML documentation. Based \
upon a patch by Michael Osipov. (schultz)
Add: In the documentation web application, be explicit that clustering \
requires a secure network for all of the cluster network traffic. (markt)
Update: Update the ASF logos to the new versions.
Fix: 60468: Correct the format of the sample ISO-8601 date used to report \
the build date for the documentation. Patch provided by Michael Osipov. (markt)
Tribes
Fix: Reduce the warning logs for a message received from a different \
domain in order to avoid excessive log outputs. (kfujino)
Add: Add log message that PING message has received beyond the timeout \
period. (kfujino)
Fix: When a PING message that beyond the time-out period has been \
received, make sure that valid member is added to the map membership. (kfujino)
WebSocket
Fix: 60437: Avoid possible handshake overflows in the websocket client. (remm)
jdbc-pool
Add: 58816: Implement the statistics of jdbc-pool. The stats infos are \
borrowedCount, returnedCount, createdCount, releasedCount, reconnectedCount, \
releasedIdleCount and removeAbandonedCount.
(kfujino)
Fix: 60194: If validationQuery is not specified, connection validation is \
done by calling the isValid() method. (kfujino)
Fix: 60398: Fix testcase of TestSlowQueryReport. (kfujino)
Add: Enable reset the statistics without restarting the pool. (kfujino)
Other
Fix: 60366: Change catalina.bat to use directly LOGGING_MANAGER and \
LOGGING_CONFIG variables in order to configure logging, instead of modifying \
JAVA_OPTS. Patch provided by Petter Isberg.
(violetagg)
Add: New property is added test.verbose in order to control whether the \
output of the tests is displayed on the console or not. Patch provided by \
Emmanuel Bourg. (violetagg)
Update: Update the ASF logos used in the Apache Tomcat installer for \
Windows to use the new versions.
Fix: Spelling corrections provided by Josh Soref. (violetagg)
---
Module Name: pkgsrc
Committed By: prlw1
Date: Mon Feb 6 15:55:49 UTC 2017
Modified Files:
pkgsrc/www/apache-tomcat8: PLIST
Log message:
Fix PLIST:
$ tar tzvf /usr/pkgsrc/distfiles/apache-tomcat-8.0.41.tar.gz | egrep 'ROOT=
.*asf-logo'
-rw-r--r-- 1 root wheel 26447 Jan 18 22:25 apache-tomcat-8.0.41/=
webapps/ROOT/asf-logo-wide.svg
|
New packages: