FEDORA-2016-2b0c16fd82 — security update for tomcat

tomcat-8.0.36-2.fc24

FEDORA-2016-2b0c16fd82 created by csutherl 3 years ago for Fedora 24

stable

This updates includes a rebase from tomcat 8.0.32 up to 8.0.36 to resolve:

#1349469 CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service

and also includes the following bug fixes:

#1341850 tomcat-jsvc.service has TOMCAT_USER value hard-coded
#1341853 rpm -V tomcat fails on /var/log/tomcat/catalina.out
#1347835 The security manager doesn't work correctly (JSPs cannot be compiled)
#1347864 The systemd service unit does not allow tomcat to shut down gracefully
#1357428 Tomcat 8.0.32 breaks deploy for candlepin.
#1359737 Missing maven depmap for the following artifacts: org.apache.tomcat:tomcat-websocket, org.apache.tomcat:tomcat-websocket-api
#1363884 The tomcat-tool-wrapper script is broken
#1364056 The command tomcat-digest doesn't work

How to install

sudo dnf upgrade --advisory=FEDORA-2016-2b0c16fd82

This update has been submitted for testing by csutherl.

3 years ago

csutherl edited this update.

3 years ago

This update has been pushed to testing.

3 years ago

anonymous commented & provided feedback 3 years ago

Solves Candlepin deploy issues!

BZ#1357428 Tomcat 8.0.32 breaks deploy for candlepin.

This update has reached 7 days in testing and can be pushed to stable now if the maintainer wishes

3 years ago

mharmsen commented & provided feedback 3 years ago

karma

I installed this build on my F24 machine alongside pki-core-10.3.5-1.fc24 and resteasy-3.0.17-1.fc24.

I used pkispawn to successfully install and configure a CA as well as enroll for a user certificate.

akurtakov commented & provided feedback 3 years ago

karma

works for me

This update has been submitted for stable by csutherl.

3 years ago

This update has been pushed to stable.

3 years ago

Please login to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

Builds

tomcat-8.0.36-2.fc24

Settings

Unstable by Karma

-3

Stable by Karma

Dates

submitted

3 years ago

in testing

3 years ago

in stable

3 years ago

modified

3 years ago

BZ#1341850 tomcat-jsvc.service has TOMCAT_USER value hard-coded

BZ#1341853 rpm -V tomcat fails on /var/log/tomcat/catalina.out

BZ#1347835 The security manager doesn't work correctly (JSPs cannot be compiled)

BZ#1347864 The systemd service unit does not allow tomcat to shut down gracefully

BZ#1349468 CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service

BZ#1349469 CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service [fedora-all]

BZ#1357428 Tomcat 8.0.32 breaks deploy for candlepin.

BZ#1359737 Missing maven depmap for the following artifacts: org.apache.tomcat:tomcat-websocket, org.apache.tomcat:tomcat-websocket-api

BZ#1363884 The tomcat-tool-wrapper script is broken

BZ#1364056 The command tomcat-digest doesn't work

tomcat-8.0.36-2.fc24

How to install

Automated Test Results