Tomcat Servlet Container development

bugzilla | 1 Aug 2008 07:45

Picon

DO NOT REPLY [Bug 42565] jsp /expression language ternary expression without space before colon stopped working

https://issues.apache.org/bugzilla/show_bug.cgi?id=42565

Magnus Melin <mkmelin+apache <at> iki.fi> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends on|                            |45511

--

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

bugzilla | 1 Aug 2008 07:45

Picon

DO NOT REPLY [Bug 45511] EL "empty" keyword does not work

https://issues.apache.org/bugzilla/show_bug.cgi?id=45511

Magnus Melin <mkmelin+apache <at> iki.fi> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mkmelin+apache <at> iki.fi
             Blocks|                            |42565

--

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

bugzilla | 1 Aug 2008 09:52

Picon

DO NOT REPLY [Bug 45516] All Tomcat http threads stuck in java.net.SocketOutputStream.socketWrite0(Native Method)

https://issues.apache.org/bugzilla/show_bug.cgi?id=45516

--- Comment #1 from Ville Hartikainen <ville.hartikainen <at> logica.com>  2008-08-01 00:52:56 PST ---
Version information of used JDK and Tomcat, as reported by "catalina.sh
version"
------------------
Using JRE_HOME:       /usr/java/jdk1.5.0_13/
Server version: Apache Tomcat/6.0.14
Server built:   Jul 20 2007 04:17:30
Server number:  6.0.14.0
OS Name:        Linux
OS Version:     2.6.18-53.1.4.el5
Architecture:   amd64
JVM Version:    1.5.0_13-b05
JVM Vendor:     Sun Microsystems Inc.

--

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

Mohn, Robert | 1 Aug 2008 14:18

Picon

When will release 6.0.18 be published to maven?

When will release 6.0.18 be published to the maven repositories?

Thanks,

-Rob

markt | 1 Aug 2008 16:05

Picon

svn commit: r681699 - in /tomcat/site/trunk: docs/security-4.html docs/security-5.html docs/security-6.html xdocs/security-4.xml xdocs/security-5.xml xdocs/security-6.xml

Author: markt
Date: Fri Aug  1 07:05:44 2008
New Revision: 681699

URL: http://svn.apache.org/viewvc?rev=681699&view=rev
Log:
Update security pages.

Modified:
    tomcat/site/trunk/docs/security-4.html
    tomcat/site/trunk/docs/security-5.html
    tomcat/site/trunk/docs/security-6.html
    tomcat/site/trunk/xdocs/security-4.xml
    tomcat/site/trunk/xdocs/security-5.xml
    tomcat/site/trunk/xdocs/security-6.xml

Modified: tomcat/site/trunk/docs/security-4.html
URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/security-4.html?rev=681699&r1=681698&r2=681699&view=diff
==============================================================================
--- tomcat/site/trunk/docs/security-4.html (original)
+++ tomcat/site/trunk/docs/security-4.html Fri Aug  1 07:05:44 2008
 <at>  <at>  -206,7 +206,6  <at>  <at> 
        vulnerabilities in the 4.0.x branch will not be fixed. Users should
        upgrade to 4.1.x, 5.5.x or 6.x to obtain security fixes.</p>

-
   </blockquote>
 </p>
 </td>
 <at>  <at>  -298,6 +297,61  <at>  <at>

(Continue reading)

Mark Thomas | 1 Aug 2008 16:06

Picon

[CVE-2008-1232] Apache Tomcat XSS vulnerability


CVE-2008-1232: Apache Tomcat XSS vulnerability

Severity: Low

Vendor:
The Apache Software Foundation

Versions Affected:
Tomcat 4.1.0 to 4.1.37
Tomcat 5.5.0 to 5.5.26
Tomcat 6.0.0 to 6.0.16
The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected

Description:
The message argument of HttpServletResponse.sendError() call is not only
displayed on the error page, but is also used for the reason-phrase of HTTP
response. This may include characters that are illegal in HTTP headers. It
is possible for a specially crafted message to result in arbitrary content
being injected into the HTTP response. For a successful XSS attack,
unfiltered user supplied data must be included in the message argument.

Mitigation:
6.0.x users should upgrade to 6.0.18
5.5.x users should obtain the latest source from svn or apply this patch
which will be included from 5.5.27
http://svn.apache.org/viewvc?rev=680947&view=rev

4.1.x users should obtain the latest source from svn or apply this patch
which will be included from 4.1.38

(Continue reading)

Mark Thomas | 1 Aug 2008 16:06

Picon

[CVE-2008-2370] Apache Tomcat information disclosure vulnerability


CVE-2008-2370: Apache Tomcat information disclosure vulnerability

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Tomcat 4.1.0 to 4.1.37
Tomcat 5.5.0 to 5.5.26
Tomcat 6.0.0 to 6.0.16
The unsupported Tomcat 3.x, 4.0.x and 5.0.x versions may be also affected

Description:
When using a RequestDispatcher the target path was normalised before the
query string was removed. A request that included a specially crafted
request parameter could be used to access content that would otherwise be
protected by a security constraint or by locating it in under the WEB-INF
directory.

Mitigation:
6.0.x users should upgrade to 6.0.18
5.5.x users should obtain the latest source from svn or apply this patch
which will be included from 5.5.27
http://svn.apache.org/viewvc?rev=680949&view=rev
4.1.x users should obtain the latest source from svn or apply this patch
which will be included from 4.1.38
http://svn.apache.org/viewvc?rev=680950&view=rev

(Continue reading)

bugzilla | 1 Aug 2008 16:47

Picon

DO NOT REPLY [Bug 45516] All Tomcat http threads stuck in java.net.SocketOutputStream.socketWrite0(Native Method)

https://issues.apache.org/bugzilla/show_bug.cgi?id=45516

Mark Thomas <markt <at> apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #2 from Mark Thomas <markt <at> apache.org>  2008-08-01 07:47:17 PST ---
This occasionally gets reported on the users list. The most recent occurrence
appears to be this thread:
http://markmail.org/message/hghfhwoxdoa6fg5s

My best guess at the moment as to the root cause is some form of network
oddity.

The users list is the best place to get help with this issue as bugzilla is
really suited to being used as a support forum.

If you investigations identify a bug in Tomcat, feel free to re-open this issue
and provide the appropriate information.

--

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

bugzilla | 1 Aug 2008 17:48

Picon

DO NOT REPLY [Bug 45523] New: Setting outputBuffer in Connector has no effect

https://issues.apache.org/bugzilla/show_bug.cgi?id=45523

           Summary: Setting outputBuffer in Connector has no effect
           Product: Tomcat 6
           Version: 6.0.13
          Platform: PC
        OS/Version: Windows Vista
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Connectors
        AssignedTo: tomcat-dev <at> jakarta.apache.org
        ReportedBy: timo.kinnunen <at> gmail.com

Increasing outputBuffer has no effect when an exception occurs when large
amount of output has already been written.

I have a JSP-file which contains the following lines:

<jsp:include page="index2.html"></jsp:include>
<u:dao beanVar="var" foo="1"></u:dao>

u:dao tag throws an NPE, which is caught in a filter and then forwarded to an
error JSP-page. Despite this, the browser receives partial contents of
index2.html. If the line order is reversed, the browser correctly receives the
contents of the error JSP. The index2.html size 36Kb.

I've tried these two Connector definitions: 

    <Connector connectionTimeout="20000" port="8080"

(Continue reading)

bugzilla | 1 Aug 2008 18:00

Picon

DO NOT REPLY [Bug 45523] Setting outputBuffer in Connector has no effect

https://issues.apache.org/bugzilla/show_bug.cgi?id=45523

Mark Thomas <markt <at> apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #1 from Mark Thomas <markt <at> apache.org>  2008-08-01 09:00:53 PST ---
The outputBuffer on the connector is not related to the output buffer for a
JSP.

Please use the users list for assistance.

--

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

Group

gmane.comp.jakarta.tomcat.devel.

Search Archive

Page

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 51

Articles in period: 508

August 2008

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

svn commit: r1486134 - in /tomcat/trunk: java/org/apache/catalina/conn (24 May 2013)
mod_jk AM_MAINTAINER_MODE nightmares (24 May 2013)
svn commit: r1486085 - /tomcat/trunk/java/org/apache/coyote/AsyncState (24 May 2013)
[Bug 55017] New: Ability to configure RMI bind address (24 May 2013)
[jira] [Created] (MTOMCAT-224) Tomcat Maven Plugin is not marked @thre (24 May 2013)
svn commit: r1486064 - /tomcat/trunk/test/org/apache/catalina/nonblock (24 May 2013)
svn commit: r1486062 - /tomcat/trunk/test/org/apache/catalina/connecto (24 May 2013)
svn commit: r1486061 - /tomcat/trunk/java/org/apache/catalina/connecto (24 May 2013)
svn commit: r1486060 - in /tomcat/trunk/java/org/apache: catalina/conn (24 May 2013)
svn commit: r1486059 - /tomcat/trunk/java/org/apache/coyote/http11/fil (24 May 2013)
svn commit: r1486056 - in /tomcat/trunk/java/org/apache/coyote/http11: (24 May 2013)
svn commit: r1485972 - /tomcat/trunk/java/org/apache/catalina/connecto (24 May 2013)
svn commit: r1485862 - /tomcat/trunk/test/org/apache/catalina/startup/ (23 May 2013)
svn commit: r1485855 - /tomcat/trunk/java/org/apache/coyote/http11/Htt (23 May 2013)
svn commit: r1485854 - /tomcat/trunk/java/org/apache/coyote/http11/Abs (23 May 2013)
svn commit: r1485847 - /tomcat/trunk/java/org/apache/tomcat/util/net/A (23 May 2013)
svn commit: r1485833 - /tomcat/trunk/test/org/apache/tomcat/util/net/T (23 May 2013)
svn commit: r1485720 - /tomcat/trunk/java/org/apache/coyote/http11/Abs (23 May 2013)
svn commit: r1485660 - in /tomcat/trunk/java/org/apache/coyote/http11: (23 May 2013)
svn commit: r1485659 - /tomcat/trunk/java/org/apache/coyote/http11/Loc (23 May 2013)
buildbot success in ASF Buildbot on tomcat-trunk (23 May 2013)

Archives

496	May 2013
601	April 2013
1143	March 2013
1048	February 2013
1196	January 2013
779	December 2012
874	November 2012
868	October 2012
573	September 2012
808	August 2012
754	July 2012
1126	June 2012
857	May 2012
658	April 2012
1521	March 2012
1073	February 2012
967	January 2012
841	December 2011
979	November 2011
1220	October 2011
887	September 2011
807	August 2011
997	July 2011
1013	June 2011
654	May 2011
478	April 2011
743	March 2011
780	February 2011
1168	January 2011
740	December 2010
956	November 2010
1158	October 2010
980	September 2010
702	August 2010
862	July 2010
746	June 2010
733	May 2010
955	April 2010
1246	March 2010
1081	February 2010
1007	January 2010
895	December 2009
1174	November 2009
449	October 2009
572	September 2009
539	August 2009
854	July 2009
1000	June 2009
464	May 2009
653	April 2009
632	March 2009
319	February 2009
463	January 2009
429	December 2008
625	November 2008
758	October 2008
669	September 2008
508	August 2008
523	July 2008
437	June 2008
538	May 2008
646	April 2008
756	March 2008
627	February 2008
989	January 2008
545	December 2007
620	November 2007
820	October 2007
645	September 2007
668	August 2007
451	July 2007
583	June 2007
792	May 2007
854	April 2007
1036	March 2007
612	February 2007
606	January 2007
781	December 2006
863	November 2006
879	October 2006
842	September 2006
696	August 2006
3487	July 2006
797	June 2006
701	May 2006
878	April 2006
966	March 2006
754	February 2006
677	January 2006
617	December 2005
726	November 2005
589	October 2005
957	September 2005
611	August 2005
988	July 2005
820	June 2005
818	May 2005
1083	April 2005
1167	March 2005
1111	February 2005
922	January 2005
1118	December 2004
1061	November 2004
1220	October 2004
1142	September 2004
1328	August 2004
1683	July 2004
946	June 2004
1122	May 2004
1196	April 2004
2254	March 2004
1597	February 2004
1437	January 2004
1006	December 2003
983	November 2003
1131	October 2003
1276	September 2003
1211	August 2003
1138	July 2003
938	June 2003
1051	May 2003
1547	April 2003
1524	March 2003
1117	February 2003
1415	January 2003
1205	December 2002
1393	November 2002
1852	October 2002
1917	September 2002
1650	August 2002
1434	July 2002
2092	June 2002
1975	May 2002
2047	April 2002
926	March 2002
1	November 2001
1	May 2000
1	October 1998

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template