[ol7_optional_latest] tomcat-jsvc-7.0.76-2.el7.noarch

Systemd service and wrapper scripts to start tomcat with jsvc,
which allows tomcat to perform some privileged operations
(e.g. bind to a port < 1024) and then switch identity to a non-privileged user.

Changelog (Show File list) (Show related packages)

• Thu Jun 08 2017 Coty Sutherland <csutherl@redhat.com> 0:7.0.76-2

  - Resolves: rhbz#1459747 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
  - Resolves: rhbz#1441481 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used

• Wed Mar 29 2017 Coty Sutherland <csutherl@redhat.com> - 0:7.0.76-1

  - Resolves: rhbz#1414895 Rebase tomcat to the current release

• Thu Aug 25 2016 Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-10

  - Related: rhbz#1368122

• Tue Aug 23 2016 Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-9

  - Resolves: rhbz#1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368122

• Wed Aug 03 2016 Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-7

  - Resolves: rhbz#1362545

• Fri Jul 08 2016 Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-6

  - Related: rhbz#1201409 Added /etc/sysconfig/tomcat to the systemd unit for tomcat-jsvc.service

• Fri Jul 01 2016 Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-5

  - Resolves: rhbz#1347860 The systemd service unit does not allow tomcat to shut down gracefully

• Mon Jun 27 2016 Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-4

  - Resolves: rhbz#1350438 CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service

• Fri Jun 17 2016 Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-3

  - Resolves: rhbz#1347774 The security manager doesn't work correctly (JSPs cannot be compiled)

• Tue Jun 07 2016 Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-2

  - Rebase Resolves: rhbz#1311622 Getting NoSuchElementException while handling attributes with empty string value in tomcat
  - Rebase Resolves: rhbz#1320853 Add HSTS support
  - Rebase Resolves: rhbz#1293292 CVE-2014-7810 tomcat: Tomcat/JBossWeb: security manager bypass via EL expressions
  - Rebase Resolves: rhbz#1347144 CVE-2016-0706 tomcat: security manager bypass via StatusManagerServlet
  - Rebase Resolves: rhbz#1347139 CVE-2015-5346 tomcat: Session fixation
  - Rebase Resolves: rhbz#1347136 CVE-2015-5345 tomcat: directory disclosure
  - Rebase Resolves: rhbz#1347129 CVE-2015-5174 tomcat: URL Normalization issue
  - Rebase Resolves: rhbz#1347146 CVE-2016-0763 tomcat: security manager bypass via setGlobalContext()
  - Rebase Resolves: rhbz#1347142 CVE-2016-0714 tomcat: Security Manager bypass via persistence mechanisms
  - Rebase Resolves: rhbz#1347133 CVE-2015-5351 tomcat: CSRF token leak