FEDORA-2016-e6651efbaf — security update for tomcat

stable

tomcat-7.0.68-3.fc22

FEDORA-2016-e6651efbaf created by van 9 years ago for Fedora 22

Revert sysconfig migration changes, resolves: #1311771, #1311905
Add /etc/tomcat/conf.d/ with shell expansion support, resolves #1293636

Load sysconfig from tomcat.conf, resolves: #1311771, #1311905
Set default javax.sql.DataSource factory to apache commons one, resolves #1214381

Updated to 7.0.68
Fix symlinks from $CATALINA_HOME/lib perspective, resolves: #1308685
Fix tomcat user shell, resolves #1302718
Remove log4j support. It has never been working actually. See #1236297
Move shipped config to /etc/sysconfig/tomcat. /etc/tomcat/tomcat.conf can now be used to override it with shell expansion, resolves #1293636
Security fix for CVE-2016-0763

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2016-e6651efbaf

This update has been submitted for testing by van.

9 years ago

This update has obsoleted tomcat-7.0.68-2.fc22, and has inherited its bugs and notes.

9 years ago

This update has been pushed to testing.

9 years ago

mharmsen commented & provided feedback 9 years ago

karma

Tested to see if there was an issue with Dogtag 10.2.6 on F22. There was, and this has been corrected by the following packages in Bodhi:

FEDORA-2016-f00f8e2144 tomcatjss-7.1.2-2.fc22
FEDORA-2016-c9a44b20fd pki-core-10.2.6-12.fc22

When used in conjunction with these two packages, this build of tomcat was tested by creating a new CA and successfully enrolling a certificate; no FreeIPA tests were attempted.

BZ#1311771 Tomcat 8.0.32 update breaks FreeIPA and Dogtag installations

This update has reached 7 days in testing and can be pushed to stable now if the maintainer wishes

9 years ago

This update has been submitted for stable by van.

9 years ago

This update has been pushed to stable.

9 years ago

Please login to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

None

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

disabled

Dates

submitted

9 years ago

in testing

9 years ago

in stable

9 years ago

Builds

tomcat-7.0.68-3.fc22

BZ#1214381 tomcat lib package doesn't include tomcat-dbcp.jar (which is required and different from apache-commons-dbcp)

BZ#1236297 log4j not working on tomcat

BZ#1293636 Systemd tomcat.service unit loads /etc/sysconfig/tomcat without shell expansion

BZ#1302718 user 'tomcat': program '/bin/nologin' does not exist

BZ#1308685 links are broken when viewed from /usr/share/tomcat/lib

BZ#1311093 CVE-2016-0763 tomcat: security manager bypass via setGlobalContext()

BZ#1311095 CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security vulnerabilities [epel-6]

BZ#1311771 Tomcat 8.0.32 update breaks FreeIPA and Dogtag installations

BZ#1311905 tomcat-8.0.32: tomcat version fails with load error org.apache.catalina.util.ServerInfo

tomcat-7.0.68-3.fc22

Automated Test Results

None