[ol7_latest] tomcat-7.0.76-15.el7.noarch

Tomcat is the servlet container that is used in the official Reference
Implementation for the Java Servlet and JavaServer Pages technologies.
The Java Servlet and JavaServer Pages specifications are developed by
Sun under the Java Community Process.

Tomcat is developed in an open and participatory environment and
released under the Apache Software License version 2.0. Tomcat is intended
to be a collaboration of the best-of-breed developers from around the world.

Changelog (Show File list) (Show related packages)

• Fri Jul 17 2020 Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15

  - Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS

• Thu May 21 2020 Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14

  - Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
  - Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence

• Wed May 06 2020 Coty Sutherland <csutherl@redhat.com> 0:7.0.76-13

  - Revert rhbz#1367492 because it caused issues with ipa-server, see rhbz#1831127

• Fri Apr 24 2020 Coty Sutherland <csutherl@redhat.com> 0:7.0.76-12

  - Resolves: rhbz#1367492 harden package permissions
  - Resolves: rhbz#1523112 tomcat systemd does not cope with - in service names
  - Resolves: rhbz#1629162 tomcat-dbcp.jar is missing from tomcat package
  - Resolves: rhbz#1822453 Tomcat parses a request having an absolute URI path incorrectly and returns 404 Not Found
  - Resolves: rhbz#1795645 connection leak with StatementCache, SlowQueryReport or StatementDecoratorInterceptor
  - Resolves: CVE-2019-17563 tomcat: session fixation when using FORM authentication

• Tue Mar 03 2020 Coty Sutherland <csutherl@redhat.com> 0:7.0.76-11

  - CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability

• Tue Sep 03 2019 Coty Sutherland <csutherl@redhat.com> 0:7.0.76-10

  - Resolves: rhbz#1748541 Bump tomcat release number

• Tue Feb 12 2019 Coty Sutherland <csutherl@redhat.com> 0:7.0.76-9

  - Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet
  - Resolves: rhbz#1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
  - Resolves: rhbz#1552374 CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
  - Resolves: rhbz#1590182 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
  - Resolves: rhbz#1608609 CVE-2018-8034 tomcat: host name verification missing in WebSocket client
  - Resolves: rhbz#1588703 Backport of Negative maxCookieCount value causes exception for Tomcat
  - Resolves: rhbz#1472950 shutdown_wait option is not working for Tomcat
  - Resolves: rhbz#1455483 Add support for characters "<" and ">" to the possible whitelist values

• Fri Oct 12 2018 Coty Sutherland <csutherl@redhat.com> 0:7.0.76-8

  - Resolves: rhbz#1608607 CVE-2018-1336 tomcat: A bug in the UTF 8 decoder can lead to DoS

• Tue Jul 24 2018 Jean-Frederic Clere <jclere@redhat.com> 0:7.0.76-7

  - Resolves: rhbz#1602060 Deadlock occurs while sending to a closing session

• Wed Nov 08 2017 Coty Sutherland <csutherl@redhat.com> 0:7.0.76-6

  - Related: rhbz#1505762 Remove erroneous useradd