Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package tomcat11 for openSUSE:Factory checked in at 2026-10-23 20:29:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/tomcat11 (Old) and /work/SRC/openSUSE:Factory/.tomcat11.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "tomcat11" Fri Oct 23 20:29:33 2026 rev:19 rq:1391995 version:11.0.27 Changes: -------- --- /work/SRC/openSUSE:Factory/tomcat11/tomcat11.changes 2026-09-29 17:54:44.060619740 +0200 +++ /work/SRC/openSUSE:Factory/.tomcat11.new.2252680/tomcat11.changes 2026-10-23 20:30:52.571068482 +0200 @@ -1,0 +2,151 @@ +Thu Oct 22 15:52:05 UTC 2026 - mbussolotto <[email protected]> + +- Update to Tomcat 11.0.27 + * Fixed CVEs: + + CVE-2026-103119: A buffer under-read meant that a large non-blocking + write could result in the response body being split between the current + request and the next request received on that connection leading most + likely to failure of the second request and possibly leakage of data + from the first response to the second. (bsc#1286363) + + CVE-2026-101356: Incorrect object recycling and re-use affecting HTTP/2 + processing of asynchronous servlets can trigger request and/or response + mix-up between users. (bsc#1286362) + + CVE-2026-101296: A missing critical step in authentication vulnerability + in Apache Tomcat when the JNDI realm was configured with with a non + GSSAPI SASL authentication mechanism allowed attackers to authenticate + without providing the correct password. (bsc#1286361) + + CVE-2026-93446: Incomplete cleanup vulnerability in Apache Tomcat could + cause TLS 1.3 connections to fail intermittently. (bsc#1286571) + + CVE-2026-88041: Incomplete cleanup vulnerability in Apache Tomcat + allowed an trailer information from a previous request to leak into a + subsequent request. (bsc#1286559) + + CVE-2026-74049: The Jasper JSTL plug-in replacement for the <c:redirect> + does not immediately end processing, allowing the rest of the page to be + processed despite the redirect. (bsc#1286555) + + CVE-2026-74048: If the OpenSSLLifecycleListener is configured to use + FIPS mode but FIPS activation fails, Tomcat logs and error but continues + to use JSSE in non-FIPS mode with the provided configuration. + (bsc#1286502) + * Catalina + + Fix: When starting a web application, don't try and use the web + application class loader until after the web application class loader + has started. (markt) + + Fix: various concurrency issues around adding and removing Realms from a + CombinedRealm, in particular doing so while the CombinedRealm is in use. + Note that once a Realm instance has been removed from a CombinedRealm + instance at run-time, the removed Realm instance may not be reused apart + from re-adding it to the same CombinedRealm. (markt) + + Update: When StoreConfig re-writes an existing server.xml or context + configuration file, preserve the layout of the existing file (comments, + blank lines and attribute order) on a best effort basis. (remm) + + Fix: Track in StandardContext whether the context was deployed from a + Context element in server.xml. Use it to have StoreConfig save to a new + config file. (remm) + + Fix: Improve error handling on start-up. (markt) + + Fix: byte range responses generated by DefaultServlet so a short + resource stream read does not truncate the response. Treat a premature + end of stream as an I/O error. Based on pull request #1067 by aoto-tech. + (markt) + + Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw + an Error when FIPS is requested but not available. (markt) + + Fix: Ensure that, as per the documentation, a simple bind is always used + when the JNDI realm binds using the user provided name and password to + authenticate the user. (markt) + + Update: Optimize Accept-Language header processing and use of resource + budles for localization. (remm) + * Coyote + + Fix: 70236: Fix a stalled TLS handshake with the OpenSSL based + implementations of SSLEngine when the first flight of handshake messages + sent by the server is too large to fit in the buffer used by the BIO + pair. Patch submitted by Lukas Hellebrandt. (remm) + + Fix: #1073: Fix possible corruption when using HTTP/2 and async IO on + uploads. Submitted by Tim Burke. (remm) + + Fix: Avoid very rare race between async write notification and + completion. Skip the write notification in these cases since it would be + useless. (remm) + + Fix: a timing issue that could cause large non-blocking writes to stall + for AJP connections. (markt) + + Fix: Improve the handling of the requirements for response closure in + section 5.7 of the Servlet specification. If a non-blocking write writes + exactly content-length bytes to the response, allow that write to + complete in a non-blocking manner before the response is closed. (markt) + + Fix: Ensure that the non-blocking write buffer is empty before sending + an AJP end response message. (markt) + + Fix: CharChunk.indexOf(char) so that it searches from the start of the + chunk rather than from twice the chunk's start offset when the chunk + does not begin at the start of its buffer. (breken-ai) + + Fix: 70247: Fix a leak in the HTTP/2 connection flow control window when + part of the HTTP request body is received but not read. Based on a patch + provided by Guillaume Darmont. (markt) + + Fix: 70251: Avoid closing a JarFile in CloseableURLConnection unless it + is certain the JAR is not shared. (remm) + + Fix: possible corruption of HTTP/1.1 chunked response bodies if a + previous write to a chunked body fails. (markt) + + Fix: Align cipher order with the results produced by OpenSSL if the + cipher specification adds, removes and then re-adds ciphers. (markt) + + Fix: Correct a narrow race condition when processing HTTP/2 headers. + (markt) + + Fix: possible TLS connections failures caused by one of the flags Tomcat + uses to track TLS handshake progress not being correctly reset. (markt) + + Fix: Allow for absolute host names in SNI checks. (markt) + + Fix: Correct a gap in asynchronous error handling that could lead to + unexpected IllegalStateExceptions for some error conditions. (markt) + + Add: Harden HTTP/2 against applications that do not correctly handle + asynchronous errors. (markt) + * Jasper + + Fix: Route JspC servlet context logging through Ant when used as an Ant + task. (sainadh777) + + Fix: the tag plugin for the JSTL <c:redirtect> tag so that page + processing ends with the redirect. (markt) + * Web applications + + Add: Documentation: Explicitly state that virtual host matching via the + HTTP host header and TLS configuration matching via SNI are completely + separate processes. (markt) + + Fix: Examples: Draw axis-aligned rectangles and ellipses as lines in the + WebSocket drawboard. (sainadh777) + * Other + + Update: the internal fork of Apache Commons BCEL to 6.13.0. (markt) + + Update: to the Eclipse JDT compiler 4.41. (markt) + + Update: to NSIS 3.13. (markt) + + Update: to Byte Buddy 1.18.14. (markt) + + Update: to Bouncy Castle 1.8.6. (markt) + + Add: Improvements to French translations. (remm) + + Add: Improvements to Japanese translations provided by tak7iji. (markt) + + Update: to Migration tool for Jakarta EE 1.0.13. (markt) + * Cluster + + Fix: Fire the documented send_message_failure lifecycle event with the + message, destination and exception when a SimpleTcpCluster message send + fails and notifyLifecycleListenerOnFailure is enabled. The event was + previously declared but never fired. (remm) + + Fix: a possible deadlock in DeltaSession.expire(): the final session + delta is now captured and sent to the cluster before the session monitor + is acquired, because obtaining the delta takes the delta lock and code + that runs while the delta lock is held, such as session attribute + listener notifications, may in turn wait for the session monitor. (remm) + + Fix: a possible deadlock in DeltaSession: session attribute listeners + are no longer called while the delta lock is held when attributes are + set or removed. The delta lock is only held while the change is + recorded. (markt) + + Fix: a possible deadlock in DeltaSession: received session deltas are + now read into a separate DeltaRequest from the one the session uses to + record local changes. This avoids having to hold the delta lock while + processing received changes. (markt) + + Fix: Move context attributes that were set while the web application was + still starting into the replicated attribute map when it is installed in + ReplicatedContext, so that they are replicated to the other nodes like + attributes set later on rather than remaining local to the node that + started the application. (remm) + + Fix: Replicate SSO session key set changes made by removeSession() and + sessionChangedId() in ClusterSingleSignOn so that SSO entries are + correctly deregistered and removed from all nodes when the last + associated session expires, even when the sessions expire on different + cluster nodes. (remm) + + Fix: an issue replicating SessionListener additions and removals that + meant some modification were not replicated leading to inconsistent + listener configurations across the cluster. (markt) + * Tribes + + Docs: Document Tribes channel, membership, transport and replication + status available through JMX. Based on pull request #1071 by sainadh777. + (markt) + +------------------------------------------------------------------- Old: ---- apache-tomcat-11.0.26-src.tar.gz apache-tomcat-11.0.26-src.tar.gz.asc New: ---- apache-tomcat-11.0.27-src.tar.gz apache-tomcat-11.0.27-src.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ tomcat11.spec ++++++ --- /var/tmp/diff_new_pack.kopEAR/_old 2026-10-23 20:30:53.503107427 +0200 +++ /var/tmp/diff_new_pack.kopEAR/_new 2026-10-23 20:30:53.504107469 +0200 @@ -29,7 +29,7 @@ %define elspec %{elspec_major}.%{elspec_minor} %define major_version 11 %define minor_version 0 -%define micro_version 26 +%define micro_version 27 %define java_major 1 %define java_minor 17 %define java_version %{java_major}.%{java_minor} ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.kopEAR/_old 2026-10-23 20:30:53.549109349 +0200 +++ /var/tmp/diff_new_pack.kopEAR/_new 2026-10-23 20:30:53.553109517 +0200 @@ -1,6 +1,6 @@ -mtime: 1790669318 -commit: e16d83fa1bb5ccdd33ab5a7e59a61533903f4ded172d8c81553c31e00cd8e06b +mtime: 1792684325 +commit: 770d7efab3d7fb90e268ed294c69789dd3844f6da8fe32043bd5f5899045536d url: https://src.opensuse.org/java-packages/tomcat11 -revision: e16d83fa1bb5ccdd33ab5a7e59a61533903f4ded172d8c81553c31e00cd8e06b +revision: 770d7efab3d7fb90e268ed294c69789dd3844f6da8fe32043bd5f5899045536d projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ apache-tomcat-11.0.26-src.tar.gz -> apache-tomcat-11.0.27-src.tar.gz ++++++ /work/SRC/openSUSE:Factory/tomcat11/apache-tomcat-11.0.26-src.tar.gz /work/SRC/openSUSE:Factory/.tomcat11.new.2252680/apache-tomcat-11.0.27-src.tar.gz differ: char 14, line 1 ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-22 17:52:05.000000000 +0200 @@ -0,0 +1 @@ +.osc
