Re: What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5

2021-07-01 Thread Shawn Heisey
On 7/1/2021 6:10 PM, James H. H. Lampert wrote: On 7/1/21 4:55 PM, Shawn Heisey wrote: In that case, you don't need h2c, and probably don't want it. O. . . . k. That makes sense, so far, but how is it even enabled? Is there some way I could have h2c enabled, with the situation I described

Question about directory listing sorting ..

2021-07-01 Thread John Dale (DB2DOM)
Doesn't seem to work for me on 9.0.41 (it's an older development box). I found these interesting: ow with patch v3: 1. "s=NA" name=asc 2. "s=ND" name=dsc 3. "s=SA" size=asc 4. "s=SD" size=dsc 5. "s=MA" modify=asc 6. "s=MD" modify=dsc >From here:

Re: What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5

2021-07-01 Thread James H. H. Lampert
On 7/1/21 4:55 PM, in response to: I will note, however, that the Tomcat servers in question are *not* configured to listen on any ports other than HTTPS (either 443, 8443, or something else in that vein) and the shutdown port. Shawn Heisey wrote: In that case, you don't need h2c, and

Re: What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5

2021-07-01 Thread Shawn Heisey
On 7/1/2021 3:24 PM, James H. H. Lampert wrote: On 6/21/21 9:42 AM, Christopher Schultz wrote: If you are using h2c, you'll definitely want to 8.5.63 or later, as there is a critical fix there. My understanding, based on what I looked up a week and a half ago, is that we're not using h2c,

Re: OpenSSL issues with Tomcat 9.0 on Corretto

2021-07-01 Thread Pawel Veselov
Hello. On Fri, Jul 2, 2021 at 1:04 AM Pawel Veselov wrote: > > Hello. > > We've been using Tomcat 9 OpenJDK(8) images for a while, but are now > trying to switch to Corretto. I sincerely apologize. I didn't realize that Tomcat images weren't maintained by the Tomcat group. I probably need to

OpenSSL issues with Tomcat 9.0 on Corretto

2021-07-01 Thread Pawel Veselov
Hello. We've been using Tomcat 9 OpenJDK(8) images for a while, but are now trying to switch to Corretto. The problem we ran into is that tomcat-native is built with OpenSSL 1.0 libraries. That makes it impossible to use Ed25519 certificates. I don't think it's possible to rectify that at

What is "h2c"? What is CVE-2021-25329? Re: Most recent security-related update to 8.5

2021-07-01 Thread James H. H. Lampert
On 6/21/21 9:42 AM, Christopher Schultz wrote: If you are using h2c, you'll definitely want to 8.5.63 or later, as there is a critical fix there. My understanding, based on what I looked up a week and a half ago, is that we're not using h2c, but at the same time, don't think I fully

JSESSION ID

2021-07-01 Thread Mohan T
Dear All, We are using tomcat 8.5.35 on Linux. We are getting two session ID for the same Http request.. Similar session ID is marked in yellow This is the session ID in startup JSESSIONID=FFE8F98C012CDB4461FC8E68C109298E This is the session ID in dispatcher

Re: Strange error with JSP

2021-07-01 Thread Konstantin Kolinko
вт, 29 июн. 2021 г. в 19:35, Christopher Schultz : > > Konstantin, > > On 6/29/21 10:21, Konstantin Kolinko wrote: > > ср, 2 июн. 2021 г. в 23:16, Christopher Schultz > > : > [...] > > Has the page been compiled once, or its modification time is being > > checked over and over, or even worse:

Re: Possible bug in http2 window size handling in tomcat 9.0.45

2021-07-01 Thread Mark Thomas
On 01/07/2021 08:41, Erik Nilsson wrote: Tx. It looks like there are multiple issues going on here then - in additional to the sendfile issue I already fixed. I'll fix the issue I'm currently seeing and then try again to recreate the issue you are seeing. I'll keep the

Re: Possible bug in http2 window size handling in tomcat 9.0.45

2021-07-01 Thread Erik Nilsson
Den tors 1 juli 2021 kl 09:32 skrev Mark Thomas : > On 01/07/2021 07:16, Erik Nilsson wrote: > > Hmm I can still get the same exceptions even if I set useAsyncIO="false", > > but with maxConcurrentStreamExecution="1" it's stable. > > Can you provide your entire Connector

Re: Possible bug in http2 window size handling in tomcat 9.0.45

2021-07-01 Thread Mark Thomas
On 01/07/2021 07:16, Erik Nilsson wrote: Hmm I can still get the same exceptions even if I set useAsyncIO="false", but with maxConcurrentStreamExecution="1" it's stable. Can you provide your entire Connector configuration that includes useAsyncIO="false" please? Thanks, Mark /Erik Den

Re: Possible bug in http2 window size handling in tomcat 9.0.45

2021-07-01 Thread Erik Nilsson
Hmm I can still get the same exceptions even if I set useAsyncIO="false", but with maxConcurrentStreamExecution="1" it's stable. /Erik Den ons 30 juni 2021 kl 18:41 skrev Mark Thomas : > On 30/06/2021 16:49, Erik Nilsson wrote: > > Perfect that u can reproduce this with another webapp. Thankful