rpms/tomcat
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Resolves: RHEL-35812 - Rebase tomcat to version 9.0.87

Browse Source 
Resolves: RHEL-29257 - tomcat: Apache Tomcat: WebSocket DoS with incomplete closing handshake
Resolves: RHEL-29252 - tomcat: Apache Tomcat: HTTP/2 header handling DoS
Resolves: RHEL-53001 - Amend tomcat's changelog so that fixed CVEs are mentioned explicitely
Remove unneeded patch file
This commit is contained in:
Sokratis Zappis 2024-05-07 17:46:46 +03:00 committed by Adam Krajcik
parent 4d63a14361
commit 9b523e3add
5 changed files with 26 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -7,3 +7,4 @@ apache-tomcat-*-src/
/tomcat-9.0.62.redhat-00014-src.zip
/tomcat-9.0.62.redhat-00017-src.zip
/tomcat-9.0.62.redhat-00018-src.zip
/tomcat-9.0.87.redhat-00003-src.zip

8
fix-malformed-dtd.patch
View File

@ -1,8 +0,0 @@
diff -up ./java/org/apache/tomcat/util/modeler/mbeans-descriptors.dtd.orig ./java/org/apache/tomcat/util/modeler/mbeans-descriptors.dtd
--- ./java/org/apache/tomcat/util/modeler/mbeans-descriptors.dtd.orig 2023-02-07 14:11:25.294179017 -0500
+++ ./java/org/apache/tomcat/util/modeler/mbeans-descriptors.dtd 2023-02-07 14:11:28.629196705 -0500
@@ -1,4 +1,3 @@
-<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with

2
sources
View File

@ -1 +1 @@
SHA512 (tomcat-9.0.62.redhat-00018-src.zip) = 926ae35bbecb0aa83efd685f0dd88a53129fab2618eed93721db5cc43d85de339e35e898a4aa52afa8c1d30c1b352ba951236b8022ea9aa1a6f3f06015a62239
SHA512 (tomcat-9.0.87.redhat-00003-src.zip) = 5064b32f5a572c7333524471a21b4781819eefbaff2449ddef9238bc09792b615b36812e499d7d7ded06b4150360396b49f1da872faad9df341451b13c45f26e

7
tomcat-build.patch
View File

@ -1,12 +1,11 @@
diff -up ./res/bnd/build-defaults.bnd.orig ./res/bnd/build-defaults.bnd
--- ./res/bnd/build-defaults.bnd.orig 2020-07-13 13:47:01.229077747 -0400
+++ ./res/bnd/build-defaults.bnd 2020-07-13 13:47:12.923095618 -0400
--- ./res/bnd/build-defaults.bnd.orig 2024-05-01 11:07:38.804582327 +0300
+++ ./res/bnd/build-defaults.bnd 2024-05-01 11:17:08.857295279 +0300
@@ -13,7 +13,7 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-Bundle-Version: ${version_cleanup;${version}}
+Bundle-Version: ${version}
Bundle-License: https://www.apache.org/licenses/LICENSE-2.0.txt
Specification-Title: Apache Tomcat
Specification-Version: ${version.major.minor}

24
tomcat.spec
View File

@ -31,8 +31,8 @@
%global jspspec 2.3
%global major_version 9
%global minor_version 0
%global micro_version 62
%global packdname %{name}-%{major_version}.%{minor_version}.%{micro_version}.redhat-00018-src
%global micro_version 87
%global packdname %{name}-%{major_version}.%{minor_version}.%{micro_version}.redhat-00003-src
%global servletspec 4.0
%global elspec 3.0
%global tcuid 53
@ -56,7 +56,7 @@
Name: tomcat
Epoch: 1
Version: %{major_version}.%{minor_version}.%{micro_version}
Release: 39%{?dist}
Release: 1%{?dist}
Summary: Apache Servlet/JSP Engine, RI for Servlet %{servletspec}/JSP %{jspspec} API
License: ASL 2.0
@ -82,7 +82,6 @@ Patch3: %{name}-%{major_version}.%{minor_version}-catalina-policy.patch
Patch4: rhbz-1857043.patch
Patch6: %{name}-%{major_version}.%{minor_version}-bnd-annotation.patch
Patch7: JmxRemoteLifecycleListener.patch
Patch8: fix-malformed-dtd.patch
BuildArch: noarch
@ -199,7 +198,6 @@ find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name "
%patch -P4 -p0
%patch -P6 -p0
%patch -P7 -p1
%patch -P8 -p1
# Remove webservices naming resources as it's generally unused
%{__rm} -rf java/org/apache/naming/factory/webservices
@ -559,18 +557,34 @@ fi
%changelog
* Fri May 03 2024 Sokratis Zappis <szappis@redhat.com> - 1:9.0.87-1
- Resolves: RHEL-35812 - Rebase tomcat to version 9.0.87
- Resolves: RHEL-29257
tomcat: Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)
- Resolves: RHEL-29252
tomcat: : Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)
- Resolves: RHEL-53001 - Amend tomcat's changelog
(CVE-2023-46589, CVE-2023-45648, CVE-2023-42795, CVE-2023-42794, CVE-2023-44487, CVE-2023-41080)
* Thu Jan 18 2024 Hui Wang <huwang@redhat.com> - 1:9.0.62-39
- Resolves: RHEL-17605
tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)
* Thu Nov 23 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-38
- Resolves: RHEL-13908
tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)
- Resolves: RHEL-13905
tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)
- Resolves: RHEL-12952
tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794)
- Resolves: RHEL-12552
tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
- Resolves: RHEL-2388
tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)
* Fri Oct 13 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-37
- Resolves: RHEL-12551
tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
- Remove JDK subpackges which are unused
* Fri Aug 25 2023 Coty Sutherland <csutherl@redhat.com> - 1:9.0.62-16