FEDORA-2016-e6651efbaf — security update for tomcat

stable

tomcat-7.0.68-3.fc22

FEDORA-2016-e6651efbaf created by van 10 years ago for Fedora 22

Revert sysconfig migration changes, resolves: #1311771, #1311905
Add /etc/tomcat/conf.d/ with shell expansion support, resolves #1293636

Load sysconfig from tomcat.conf, resolves: #1311771, #1311905
Set default javax.sql.DataSource factory to apache commons one, resolves #1214381

Updated to 7.0.68
Fix symlinks from $CATALINA_HOME/lib perspective, resolves: #1308685
Fix tomcat user shell, resolves #1302718
Remove log4j support. It has never been working actually. See #1236297
Move shipped config to /etc/sysconfig/tomcat. /etc/tomcat/tomcat.conf can now be used to override it with shell expansion, resolves #1293636
Security fix for CVE-2016-0763

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2016-e6651efbaf

This update has been submitted for testing by van.

10 years ago

This update has obsoleted tomcat-7.0.68-2.fc22, and has inherited its bugs and notes.

10 years ago

This update has been pushed to testing.

10 years ago

mharmsen commented & provided feedback 10 years ago

karma

Tested to see if there was an issue with Dogtag 10.2.6 on F22. There was, and this has been corrected by the following packages in Bodhi:

FEDORA-2016-f00f8e2144 tomcatjss-7.1.2-2.fc22
FEDORA-2016-c9a44b20fd pki-core-10.2.6-12.fc22

When used in conjunction with these two packages, this build of tomcat was tested by creating a new CA and successfully enrolling a certificate; no FreeIPA tests were attempted.

BZ#1311771 Tomcat 8.0.32 update breaks FreeIPA and Dogtag installations

This update has reached 7 days in testing and can be pushed to stable now if the maintainer wishes

10 years ago

This update has been submitted for stable by van.

10 years ago

This update has been pushed to stable.

10 years ago

Please log in to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

None

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

disabled

Dates

submitted

10 years ago

in testing

10 years ago

in stable

10 years ago

Builds

tomcat-7.0.68-3.fc22

BZ#1214381 tomcat lib package doesn't include tomcat-dbcp.jar (which is required and different from apache-commons-dbcp)

BZ#1236297 log4j not working on tomcat

BZ#1293636 Systemd tomcat.service unit loads /etc/sysconfig/tomcat without shell expansion

BZ#1302718 user 'tomcat': program '/bin/nologin' does not exist

BZ#1308685 links are broken when viewed from /usr/share/tomcat/lib

BZ#1311093 CVE-2016-0763 tomcat: security manager bypass via setGlobalContext()

BZ#1311095 CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [epel-6]

BZ#1311771 Tomcat 8.0.32 update breaks FreeIPA and Dogtag installations

BZ#1311905 tomcat-8.0.32: tomcat version fails with load error org.apache.catalina.util.ServerInfo

tomcat-7.0.68-3.fc22

Automated Test Results

None