{"update": {"autokarma": true, "autotime": false, "stable_karma": 3, "stable_days": 0, "unstable_karma": -3, "require_bugs": true, "require_testcases": true, "display_name": "", "notes": "The update provides resolutions for 11 bugs, including 7 CVE fixes and a rebase from version 7.0.65 to 7.0.70.\n\n", "type": "security", "status": "stable", "request": null, "severity": "medium", "suggest": "unspecified", "locked": false, "pushed": true, "critpath": false, "critpath_groups": null, "close_bugs": true, "date_submitted": "2016-08-05 20:10:18", "date_modified": "2016-08-08 12:58:06", "date_approved": null, "date_testing": "2016-08-09 02:06:10", "date_stable": "2016-09-02 09:19:55", "alias": "FEDORA-EPEL-2016-3ff1f4485b", "test_gating_status": null, "from_tag": null, "date_pushed": "2016-09-02 09:19:55", "meets_testing_requirements": false, "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-3ff1f4485b", "title": "tomcat-7.0.70-2.el6", "version_hash": "cfd53f391b0573de31662d209be51597f2c8b66b", "release": {"name": "EL-6", "long_name": "Fedora EPEL 6", "version": "6", "id_prefix": "FEDORA-EPEL", "branch": "el6", "dist_tag": "dist-6E-epel", "stable_tag": "dist-6E-epel", "testing_tag": "dist-6E-epel-testing", "candidate_tag": "dist-6E-epel-testing-candidate", "pending_signing_tag": "", "pending_testing_tag": "", "pending_stable_tag": "", "override_tag": "dist-6E-epel-override", "mail_template": "fedora_epel_legacy_errata_template", "state": "archived", "composed_by_bodhi": true, "create_automatic_updates": false, "package_manager": "unspecified", "testing_repository": null, "released_on": null, "eol": null, "critpath_mandatory_days_in_testing": 14, "mandatory_days_in_testing": 7, "critpath_min_karma": 2, "min_karma": 1, "setting_status": null}, "user": {"name": "csutherl", "email": "csutherl@redhat.com", "id": 2565, "avatar": "https://seccdn.libravatar.org/avatar/d44964302ea7dbc5b71ae38cf11aa7dc1d59882f834050d7411a36dec8d5a106?s=24&d=retro", "openid": "csutherl.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "diversity-team"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for testing by csutherl. ", "timestamp": "2016-08-05 20:10:18", "update_id": 64017, "user_id": 91, "id": 467570, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "csutherl edited this update.", "timestamp": "2016-08-05 20:14:02", "update_id": 64017, "user_id": 91, "id": 467571, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "csutherl edited this update.", "timestamp": "2016-08-08 12:58:06", "update_id": 64017, "user_id": 91, "id": 468176, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to testing.", "timestamp": "2016-08-09 02:18:14", "update_id": 64017, "user_id": 91, "id": 468678, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes", "timestamp": "2016-08-23 06:00:14", "update_id": 64017, "user_id": 91, "id": 475450, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for stable by csutherl. ", "timestamp": "2016-08-31 18:43:30", "update_id": 64017, "user_id": 91, "id": 480125, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to stable.", "timestamp": "2016-09-02 09:22:57", "update_id": 64017, "user_id": 91, "id": 481054, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}], "builds": [{"nvr": "tomcat-7.0.70-2.el6", "signed": true, "release_id": 10, "type": "rpm", "epoch": 0}], "bugs": [{"bug_id": 1104704, "title": "/usr/sbin/tomcat overrides settings specified in /etc/sysconfig/${NAME}", "security": false, "parent": false, "feedback": []}, {"bug_id": 1104708, "title": "Tomcat init script does not respect setting of CATALINA_PID in /etc/sysconfig/tomcat", "security": false, "parent": false, "feedback": []}, {"bug_id": 1311076, "title": "CVE-2015-5351 tomcat: CSRF token leak", "security": true, "parent": true, "feedback": []}, {"bug_id": 1311082, "title": "CVE-2016-0714 tomcat: Security Manager bypass via persistence mechanisms", "security": true, "parent": true, "feedback": []}, {"bug_id": 1311085, "title": "CVE-2015-5346 tomcat: Session fixation", "security": true, "parent": true, "feedback": []}, {"bug_id": 1311087, "title": "CVE-2016-0706 tomcat: security manager bypass via StatusManagerServlet", "security": true, "parent": true, "feedback": []}, {"bug_id": 1311089, "title": "CVE-2015-5345 tomcat: directory disclosure", "security": true, "parent": true, "feedback": []}, {"bug_id": 1311093, "title": "CVE-2016-0763 tomcat: security manager bypass via setGlobalContext()", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 393199, "bug_id": 1311093, "comment": {"karma": -1, "karma_critpath": 0, "text": "This update will break all FreeIPA or Dogtag installations, as some classes were moved around into different jar files.  Anyone that installs this update and tries to restart their Dogtag or FreeIPA services will have a failure when tomcat starts up with the following error in the journal:\n\n    Error: Could not find or load main class org.apache.catalina.startup.Bootstrap\n\nI will file a bug about this, but I don't think this is something that should be updated in F23 since it's not backwards compatible and breaks people's installations.", "timestamp": "2016-02-24 23:54:29", "update_id": 51350, "user_id": 1346, "id": 393199, "testcase_feedback": [], "user": {"name": "nkinder", "email": "nkinder@redhat.com", "id": 1346, "avatar": "https://seccdn.libravatar.org/avatar/238c59fe1265eca13213cbc7500c271516a5059936578330f0e0a5b7067693a9?s=24&d=retro", "openid": "nkinder.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 393224, "bug_id": 1311093, "comment": {"karma": 0, "karma_critpath": 0, "text": "I have filed Fedora#1311771 for the issue mentioned above.", "timestamp": "2016-02-25 00:09:06", "update_id": 51350, "user_id": 1346, "id": 393224, "testcase_feedback": [], "user": {"name": "nkinder", "email": "nkinder@redhat.com", "id": 1346, "avatar": "https://seccdn.libravatar.org/avatar/238c59fe1265eca13213cbc7500c271516a5059936578330f0e0a5b7067693a9?s=24&d=retro", "openid": "nkinder.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 393225, "bug_id": 1311093, "comment": {"karma": -1, "karma_critpath": 0, "text": "", "timestamp": "2016-02-25 00:10:03", "update_id": 51350, "user_id": 1346, "id": 393225, "testcase_feedback": [], "user": {"name": "nkinder", "email": "nkinder@redhat.com", "id": 1346, "avatar": "https://seccdn.libravatar.org/avatar/238c59fe1265eca13213cbc7500c271516a5059936578330f0e0a5b7067693a9?s=24&d=retro", "openid": "nkinder.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 393323, "bug_id": 1311093, "comment": {"karma": -1, "karma_critpath": 0, "text": "I can confirm that this breaks FreeIPA/Dogtag installation in F23 as nkinder pointed out.", "timestamp": "2016-02-25 08:50:51", "update_id": 51350, "user_id": 1567, "id": 393323, "testcase_feedback": [], "user": {"name": "mbabinsk", "email": "mbabinsk@redhat.com", "id": 1567, "avatar": "https://seccdn.libravatar.org/avatar/abf8f97fed2d2d9cc024eb8a796b96500b124fbf8fdb541a9a189fa082adb6c1?s=24&d=retro", "openid": "mbabinsk.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 393612, "bug_id": 1311093, "comment": {"karma": -1, "karma_critpath": 0, "text": "This version has the same same issue as the latest 8.0. It breaks Dogtag and FreeIPA.\n\n    # rpm -qa tomcat\n    tomcat-7.0.68-1.fc22.noarch\n    # tomcat version\n    Error: Could not find or load main class org.apache.catalina.util.ServerInfo\n\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1311771\n", "timestamp": "2016-02-25 22:19:18", "update_id": 51382, "user_id": 2622, "id": 393612, "testcase_feedback": [], "user": {"name": "cheimes", "email": "cheimes@redhat.com", "id": 2622, "avatar": "https://seccdn.libravatar.org/avatar/fb01cd1580c9fa10cf453f7c77b9a5ac59f645883d7bf9f921743803e0379c8d?s=24&d=retro", "openid": "cheimes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "python-sig"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "gitfreeipa"}, {"name": "git389"}, {"name": "latchset"}, {"name": "gitpki"}, {"name": "python-packagers-sig"}, {"name": "podengo"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 394706, "bug_id": 1311093, "comment": {"karma": -1, "karma_critpath": 0, "text": "The update has the same problems as tomcat-8.0.32-4.fc23. tomcat version works but Dogtag still fails to start.", "timestamp": "2016-02-29 09:03:45", "update_id": 51600, "user_id": 2622, "id": 394706, "testcase_feedback": [], "user": {"name": "cheimes", "email": "cheimes@redhat.com", "id": 2622, "avatar": "https://seccdn.libravatar.org/avatar/fb01cd1580c9fa10cf453f7c77b9a5ac59f645883d7bf9f921743803e0379c8d?s=24&d=retro", "openid": "cheimes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "python-sig"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "gitfreeipa"}, {"name": "git389"}, {"name": "latchset"}, {"name": "gitpki"}, {"name": "python-packagers-sig"}, {"name": "podengo"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 394865, "bug_id": 1311093, "comment": {"karma": -1, "karma_critpath": 0, "text": "Breaks Dogtag, too bad.", "timestamp": "2016-02-29 14:40:13", "update_id": 51600, "user_id": 1315, "id": 394865, "testcase_feedback": [], "user": {"name": "pspacek", "email": "pspacek@isc.org", "id": 1315, "avatar": "https://seccdn.libravatar.org/avatar/049899d532021a7d606b289ecbf5057881630ce86d462929043ee598de5219a7?s=24&d=retro", "openid": "pspacek.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}, {"karma": 0, "comment_id": 402430, "bug_id": 1311093, "comment": {"karma": 1, "karma_critpath": 0, "text": "Tested to see if there was an issue with Dogtag 10.2.6 on F22.  There was, and this has been corrected by the following packages in Bodhi:\n\n* https://bodhi.fedoraproject.org/updates/FEDORA-2016-f00f8e2144 tomcatjss-7.1.2-2.fc22\n* https://bodhi.fedoraproject.org/updates/FEDORA-2016-c9a44b20fd pki-core-10.2.6-12.fc22\n\nWhen used in conjunction with these two packages, this build of tomcat was tested by creating a new CA and successfully enrolling a certificate; no FreeIPA tests were attempted.", "timestamp": "2016-03-17 20:45:38", "update_id": 52578, "user_id": 475, "id": 402430, "testcase_feedback": [], "user": {"name": "mharmsen", "email": "mharmsen@redhat.com", "id": 475, "avatar": "https://seccdn.libravatar.org/avatar/148f133379f547c8dc0e09e8a25946e2e8fa2f579602eb9fba8695b8a99a651e?s=24&d=retro", "openid": "mharmsen.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}]}, {"bug_id": 1311499, "title": "Updating package causes tomcat to not start on boot.", "security": false, "parent": false, "feedback": []}, {"bug_id": 1312280, "title": "Unable to overwrite the TOMCAT_SCRIPT variable", "security": false, "parent": false, "feedback": []}, {"bug_id": 1314177, "title": "Tomcat init script reports wrong status when one instance of several is stopped", "security": false, "parent": false, "feedback": []}, {"bug_id": 1327327, "title": "rpm -V tomcat fails on /var/log/tomcat/catalina.out", "security": false, "parent": false, "feedback": []}, {"bug_id": 1347838, "title": "The security manager doesn't work correctly (JSPs cannot be compiled)", "security": false, "parent": false, "feedback": []}, {"bug_id": 1349468, "title": "CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 471494, "bug_id": 1349468, "comment": {"karma": 0, "karma_critpath": 0, "text": "Solves Candlepin deploy issues!", "timestamp": "2016-08-15 08:46:58", "update_id": 64555, "user_id": 207, "id": 471494, "testcase_feedback": [], "user": {"name": "anonymous", "email": null, "id": 207, "avatar": "https://seccdn.libravatar.org/avatar/37a8eec1ce19687d132fe29051dca629d164e2c4958ba141d5f4133a33f0688f?s=24&d=retro", "openid": "anonymous.id.fedoraproject.org", "groups": []}}}, {"karma": 0, "comment_id": 475300, "bug_id": 1349468, "comment": {"karma": 1, "karma_critpath": 0, "text": "I installed this build on my F24 machine alongside pki-core-10.3.5-1.fc24 and resteasy-3.0.17-1.fc24.\n\nI used pkispawn to successfully install and configure a CA as well as enroll for a user certificate.", "timestamp": "2016-08-22 21:11:18", "update_id": 64555, "user_id": 475, "id": 475300, "testcase_feedback": [], "user": {"name": "mharmsen", "email": "mharmsen@redhat.com", "id": 475, "avatar": "https://seccdn.libravatar.org/avatar/148f133379f547c8dc0e09e8a25946e2e8fa2f579602eb9fba8695b8a99a651e?s=24&d=retro", "openid": "mharmsen.id.fedoraproject.org", "groups": [{"name": "packager"}]}}}]}, {"bug_id": 1352009, "title": "CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 CVE-2016-3092 tomcat: multiple security vulnerabilities [epel-6]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1352120, "title": "The javadoc package is useless; it contains one index.html", "security": false, "parent": false, "feedback": []}, {"bug_id": 1364067, "title": "The tomcat-tool-wrapper script is broken", "security": false, "parent": false, "feedback": []}, {"bug_id": 1364068, "title": "The command tomcat-digest doesn't work", "security": false, "parent": false, "feedback": []}], "updateid": "FEDORA-EPEL-2016-3ff1f4485b", "karma": 0, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}