From 0241bac10dec9c03f15891b88c54e5b3630d6c92 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 30 Mar 2026 10:04:25 -0400 Subject: [PATCH] import CS tomcat-9.0.110-2.el9 --- .gitignore | 2 +- .tomcat.metadata | 2 +- SOURCES/JmxRemoteLifecycleListener.patch | 40 ------------------------ SOURCES/rhbz-1857043.patch | 29 ++++++++++------- SPECS/tomcat.spec | 37 ++++++++++++++++------ 5 files changed, 48 insertions(+), 62 deletions(-) delete mode 100644 SOURCES/JmxRemoteLifecycleListener.patch diff --git a/.gitignore b/.gitignore index 9d97386..d099beb 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/tomcat-9.0.87.redhat-00012-src.zip +SOURCES/apache-tomcat-9.0.110-src.tar.gz diff --git a/.tomcat.metadata b/.tomcat.metadata index 3213092..28d53a0 100644 --- a/.tomcat.metadata +++ b/.tomcat.metadata @@ -1 +1 @@ -8b767b774d19e223f1fa9f4bb07e0db94234978a SOURCES/tomcat-9.0.87.redhat-00012-src.zip +8c9f0f1e544993d3ff75fc08017643159ccf05be SOURCES/apache-tomcat-9.0.110-src.tar.gz diff --git a/SOURCES/JmxRemoteLifecycleListener.patch b/SOURCES/JmxRemoteLifecycleListener.patch deleted file mode 100644 index 3145a54..0000000 --- a/SOURCES/JmxRemoteLifecycleListener.patch +++ /dev/null @@ -1,40 +0,0 @@ -diff --git a/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java b/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java -index f62f8d1..db19960 100644 ---- a/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java -+++ b/java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java -@@ -611,34 +611,28 @@ public class JmxRemoteLifecycleListener extends SSLHostConfig implements Lifecyc - * Better to use the internal API than re-invent the wheel. - */ - @SuppressWarnings("restriction") -- private static class JmxRegistry extends sun.rmi.registry.RegistryImpl { -+ private static class JmxRegistry { - private static final long serialVersionUID = -3772054804656428217L; - private final String jmxName; - private final Remote jmxServer; - public JmxRegistry(int port, RMIClientSocketFactory csf, - RMIServerSocketFactory ssf, String jmxName, Remote jmxServer) throws RemoteException { -- super(port, csf, ssf); - this.jmxName = jmxName; - this.jmxServer = jmxServer; - } -- @Override - public Remote lookup(String name) - throws RemoteException, NotBoundException { - return (jmxName.equals(name)) ? jmxServer : null; - } -- @Override - public void bind(String name, Remote obj) - throws RemoteException, AlreadyBoundException, AccessException { - } -- @Override - public void unbind(String name) - throws RemoteException, NotBoundException, AccessException { - } -- @Override - public void rebind(String name, Remote obj) - throws RemoteException, AccessException { - } -- @Override - public String[] list() throws RemoteException { - return new String[] { jmxName }; - } diff --git a/SOURCES/rhbz-1857043.patch b/SOURCES/rhbz-1857043.patch index dd74c3b..47d2276 100644 --- a/SOURCES/rhbz-1857043.patch +++ b/SOURCES/rhbz-1857043.patch @@ -1,7 +1,6 @@ -diff -up ./build.xml.orig ./build.xml ---- build.xml.orig 2021-07-07 10:53:55.493742841 +0800 -+++ build.xml 2021-07-07 11:09:43.107968515 +0800 -@@ -1020,7 +1020,7 @@ +--- build.xml.orig 2026-02-11 15:17:18.947314996 -0500 ++++ build.xml 2026-02-11 15:17:23.675329041 -0500 +@@ -1116,7 +1116,7 @@ filesDir="${tomcat.classes}" filesId="files.annotations-api" manifest="${tomcat.manifests}/annotations-api.jar.manifest" @@ -10,7 +9,7 @@ diff -up ./build.xml.orig ./build.xml ++ addOSGi="false" /> + + + + addOSGi="false" /> @@ -130,7 +137,7 @@ diff -up ./build.xml.orig ./build.xml = 1:1.8 or java-1.8.0-headless or java-11-headless or java-17-headless or java-21-headless or java >= 1:1.8) +Requires: (java-headless >= 1:1.8 or java-1.8.0-headless or java-11-headless or java-17-headless or java-21-headless or java-25-headless or java >= 1:1.8) Requires: javapackages-tools Requires: %{name}-lib = %{epoch}:%{version}-%{release} %if 0%{?fedora} || 0%{?rhel} > 7 @@ -186,7 +186,7 @@ Requires: %{name} = %{epoch}:%{version}-%{release} The ROOT web application for Apache Tomcat. %prep -%setup -q -n apache-%{packdname} +%setup -q -n %{packdname} # remove pre-built binaries and windows files find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name "*.gz" -o \ -name "*.jar" -o -name "*.war" -o -name "*.zip" \) -delete @@ -197,7 +197,6 @@ find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name " %patch -P3 -p0 %patch -P4 -p0 %patch -P6 -p0 -%patch -P7 -p1 # Remove webservices naming resources as it's generally unused %{__rm} -rf java/org/apache/naming/factory/webservices @@ -217,8 +216,12 @@ export OPT_JAR_LIST="xalan-j2-serializer" # so just create a dummy file for later removal touch HACK +# Adding JAVA_HOME to always compile with java-25 instead of autodetecting +export JAVA_HOME=%{_jvmdir}/java-25-openjdk +export PATH=$JAVA_HOME/bin:$PATH + # who needs a build.properties file anyway -%{ant} -Dbase.path="." \ +ant -Dbase.path="." \ -Dbuild.compiler="modern" \ -Dcommons-daemon.jar="HACK" \ -Dcommons-daemon.native.src.tgz="HACK" \ @@ -237,6 +240,9 @@ touch HACK # remove some jars that we'll replace with symlinks later %{__rm} output/build/lib/ecj.jar +# Cleanup commons-daemon.jar that somehow appeared since last build, but is unnecessary +%{__rm} -rf output/build/bin/commons-daemon.jar + # Remove the example webapps per Apache Tomcat Security Considerations # see https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html %{__rm} -rf output/build/webapps/examples @@ -557,6 +563,19 @@ fi %changelog +* Thu Feb 26 2026 Coty Sutherland - 1:9.0.110-2 +- Resolves: RHEL-154364 Tomcat fails to respond to client connections when using Java 8 + +* Wed Feb 11 2026 Coty Sutherland - 1:9.0.110-1 +- Resolves: RHEL-148687 + Update to 9.0.110 and compile with Java 25 to enable FFM features for PQC support + +* Wed Jan 21 2026 Pietro Meloni - 1:9.0.87-7 +- Resolves: RHEL-124516 + tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) +- Resolves: RHEL-132561 + tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) + * Thu Aug 14 2025 Adam Krajcik - 1:9.0.87-6 - Resolves: RHEL-102201 tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)