Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package tomcat10 for openSUSE:Factory checked in at 2026-10-23 20:29:32 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/tomcat10 (Old) and /work/SRC/openSUSE:Factory/.tomcat10.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "tomcat10" Fri Oct 23 20:29:32 2026 rev:37 rq:1391993 version:10.1.61 Changes: -------- --- /work/SRC/openSUSE:Factory/tomcat10/tomcat10.changes 2026-09-29 17:54:41.100496152 +0200 +++ /work/SRC/openSUSE:Factory/.tomcat10.new.2252680/tomcat10.changes 2026-10-23 20:30:48.386893648 +0200 @@ -1,0 +2,149 @@ +Thu Oct 22 15:49:18 UTC 2026 - mbussolotto <[email protected]> + +- Update to Tomcat 10.1.61 + * Fixed CVEs: + + CVE-2026-101356: Incorrect object recycling and re-use affecting HTTP/2 + processing of asynchronous servlets can trigger request and/or response + mix-up between users. (bsc#1286362) + + CVE-2026-101296: A missing critical step in authentication vulnerability + in Apache Tomcat when the JNDI realm was configured with with a non + GSSAPI SASL authentication mechanism allowed attackers to authenticate + without providing the correct password. (bsc#1286361) + + CVE-2026-93446: Incomplete cleanup vulnerability in Apache Tomcat could + cause TLS 1.3 connections to fail intermittently. (bsc#1286571) + + CVE-2026-88041: Incomplete cleanup vulnerability in Apache Tomcat + allowed an trailer information from a previous request to leak into a + subsequent request. (bsc#1286559) + + CVE-2026-74049: The Jasper JSTL plug-in replacement for the <c:redirect> + does not immediately end processing, allowing the rest of the page to be + processed despite the redirect. (bsc#1286555) + + CVE-2026-74048: If the OpenSSLLifecycleListener is configured to use + FIPS mode but FIPS activation fails, Tomcat logs and error but continues + to use JSSE in non-FIPS mode with the provided configuration. + (bsc#1286502) + * Catalina + + Fix: When starting a web application, don't try and use the web + application class loader until after the web application class loader + has started. (markt) + + Fix: various concurrency issues around adding and removing Realms from a + CombinedRealm, in particular doing so while the CombinedRealm is in use. + Note that once a Realm instance has been removed from a CombinedRealm + instance at run-time, the removed Realm instance may not be reused apart + from re-adding it to the same CombinedRealm. (markt) + + Update: When StoreConfig re-writes an existing server.xml or context + configuration file, preserve the layout of the existing file (comments, + blank lines and attribute order) on a best effort basis. (remm) + + Fix: Track in StandardContext whether the context was deployed from a + Context element in server.xml. Use it to have StoreConfig save to a new + config file. (remm) + + Fix: Improve error handling on start-up. (markt) + + Fix: byte range responses generated by DefaultServlet so a short + resource stream read does not truncate the response. Treat a premature + end of stream as an I/O error. Based on pull request #1067 by aoto-tech. + (markt) + + Fix: Align OpenSSLLifecycleListener with AprLifecycleListener and throw + an Error when FIPS is requested but not available. (markt) + + Fix: Ensure that, as per the documentation, a simple bind is always used + when the JNDI realm binds using the user provided name and password to + authenticate the user. (markt) + + Update: Optimize Accept-Language header processing and use of resource + budles for localization. (remm) + * Coyote + + Fix: 70236: Fix a stalled TLS handshake with the OpenSSL based + implementations of SSLEngine when the first flight of handshake messages + sent by the server is too large to fit in the buffer used by the BIO + pair. Patch submitted by Lukas Hellebrandt. (remm) + + Fix: #1073: Fix possible corruption when using HTTP/2 and async IO on + uploads. Submitted by Tim Burke. (remm) + + Fix: Avoid very rare race between async write notification and + completion. Skip the write notification in these cases since it would be + useless. (remm) + + Fix: a timing issue that could cause large non-blocking writes to stall + for AJP connections. (markt) + + Fix: Ensure that the non-blocking write buffer is empty before sending + an AJP end response message. (markt) + + Fix: CharChunk.indexOf(char) so that it searches from the start of the + chunk rather than from twice the chunk's start offset when the chunk + does not begin at the start of its buffer. (breken-ai) + + Fix: 70247: Fix a leak in the HTTP/2 connection flow control window when + part of the HTTP request body is received but not read. Based on a patch + provided by Guillaume Darmont. (markt) + + Fix: 70251: Avoid closing a JarFile in CloseableURLConnection unless it + is certain the JAR is not shared. (remm) + + Fix: possible corruption of HTTP/1.1 chunked response bodies if a + previous write to a chunked body fails. (markt) + + Fix: Align cipher order with the results produced by OpenSSL if the + cipher specification adds, removes and then re-adds ciphers. (markt) + + Fix: Correct a narrow race condition when processing HTTP/2 headers. + (markt) + + Fix: possible TLS connections failures caused by one of the flags Tomcat + uses to track TLS handshake progress not being correctly reset. (markt) + + Fix: Allow for absolute host names in SNI checks. (markt) + + Fix: Correct a gap in asynchronous error handling that could lead to + unexpected IllegalStateExceptions for some error conditions. (markt) + + Add: Harden HTTP/2 against applications that do not correctly handle + asynchronous errors. (markt) + * Jasper + + Fix: Route JspC servlet context logging through Ant when used as an Ant + task. (sainadh777) + + Fix: the tag plugin for the JSTL <c:redirtect> tag so that page + processing ends with the redirect. (markt) + * Web applications + + Add: Documentation: Explicitly state that virtual host matching via the + HTTP host header and TLS configuration matching via SNI are completely + separate processes. (markt) + + Fix: Examples: Draw axis-aligned rectangles and ellipses as lines in the + WebSocket drawboard. (sainadh777) + * Other + + Update: the internal fork of Apache Commons BCEL to 6.13.0. (markt) + + Update: to NSIS 3.13. (markt) + + Update: to Byte Buddy 1.18.14. (markt) + + Update: to Bouncy Castle 1.8.6. (markt) + + Add: Improvements to French translations. (remm) + + Add: Improvements to Japanese translations provided by tak7iji. (markt) + + Update: to Migration tool for Jakarta EE 1.0.13. (markt) + * Cluster + + Fix: Replicate SSO session key set changes made by removeSession() and + sessionChangedId() in ClusterSingleSignOn so that SSO entries are + correctly deregistered and removed from all nodes when the last + associated session expires, even when the sessions expire on different + cluster nodes. (remm) + + Fix: Move context attributes that were set while the web application was + still starting into the replicated attribute map when it is installed in + ReplicatedContext, so that they are replicated to the other nodes like + attributes set later on rather than remaining local to the node that + started the application. (remm) + + Fix: a possible deadlock in DeltaSession.expire(): the final session + delta is now captured and sent to the cluster before the session monitor + is acquired, because obtaining the delta takes the delta lock and code + that runs while the delta lock is held, such as session attribute + listener notifications, may in turn wait for the session monitor. (remm) + + Fix: Fire the documented send_message_failure lifecycle event with the + message, destination and exception when a SimpleTcpCluster message send + fails and notifyLifecycleListenerOnFailure is enabled. The event was + previously declared but never fired. (remm) + + Fix: a possible deadlock in DeltaSession: session attribute listeners + are no longer called while the delta lock is held when attributes are + set or removed. The delta lock is only held while the change is + recorded. (markt) + + Fix: a possible deadlock in DeltaSession: received session deltas are + now read into a separate DeltaRequest from the one the session uses to + record local changes. This avoids having to hold the delta lock while + processing received changes. (markt) + + Fix: Move context attributes that were set while the web application was + still starting into the replicated attribute map when it is installed in + ReplicatedContext, so that they are replicated to the other nodes like + attributes set later on rather than remaining local to the node that + started the application. (remm) + + Fix: an issue replicating SessionListener additions and removals that + meant some modification were not replicated leading to inconsistent + listener configurations across the cluster. (markt) + * Tribes + + Docs: Document Tribes channel, membership, transport and replication + status available through JMX. Based on pull request #1071 by sainadh777. + (markt) +- Modified patch: + * tomcat-10.1-build-with-java-11.patch + + rediff to changed context + +------------------------------------------------------------------- Old: ---- apache-tomcat-10.1.60-src.tar.gz apache-tomcat-10.1.60-src.tar.gz.asc New: ---- apache-tomcat-10.1.61-src.tar.gz apache-tomcat-10.1.61-src.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ tomcat10.spec ++++++ --- /var/tmp/diff_new_pack.T8w8kd/_old 2026-10-23 20:30:50.812995022 +0200 +++ /var/tmp/diff_new_pack.T8w8kd/_new 2026-10-23 20:30:50.815995147 +0200 @@ -29,7 +29,7 @@ %define elspec %{elspec_major}.%{elspec_minor} %define major_version 10 %define minor_version 1 -%define micro_version 60 +%define micro_version 61 %define java_major 1 %define java_minor 11 %define java_version %{java_major}.%{java_minor} ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.T8w8kd/_old 2026-10-23 20:30:50.931999995 +0200 +++ /var/tmp/diff_new_pack.T8w8kd/_new 2026-10-23 20:30:50.940000329 +0200 @@ -1,6 +1,6 @@ -mtime: 1790669312 -commit: 14cd97589fce50d9c08a8c98a09ff909f0a3e746c09494b171b4640ad293504f +mtime: 1792740595 +commit: cc68e9318eb2ee503c14cbf5d718cc901db8952a2a896402bcc98ec5478f9cdc url: https://src.opensuse.org/java-packages/tomcat10 -revision: 14cd97589fce50d9c08a8c98a09ff909f0a3e746c09494b171b4640ad293504f +revision: cc68e9318eb2ee503c14cbf5d718cc901db8952a2a896402bcc98ec5478f9cdc projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj ++++++ apache-tomcat-10.1.60-src.tar.gz -> apache-tomcat-10.1.61-src.tar.gz ++++++ /work/SRC/openSUSE:Factory/tomcat10/apache-tomcat-10.1.60-src.tar.gz /work/SRC/openSUSE:Factory/.tomcat10.new.2252680/apache-tomcat-10.1.61-src.tar.gz differ: char 13, line 1 ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-23 09:29:55.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ tomcat-10.1-build-with-java-11.patch ++++++ --- /var/tmp/diff_new_pack.T8w8kd/_old 2026-10-23 20:30:51.369018255 +0200 +++ /var/tmp/diff_new_pack.T8w8kd/_new 2026-10-23 20:30:51.377018590 +0200 @@ -1,14 +1,14 @@ -Index: apache-tomcat-10.1.25-src/build.xml +Index: apache-tomcat-10.1.61-src/build.xml =================================================================== ---- apache-tomcat-10.1.25-src.orig/build.xml -+++ apache-tomcat-10.1.25-src/build.xml +--- apache-tomcat-10.1.61-src.orig/build.xml ++++ apache-tomcat-10.1.61-src/build.xml @@ -108,7 +108,7 @@ <!-- Keep in sync with webapps/docs/tomcat-docs.xsl --> <property name="compile.release" value="11"/> <property name="min.java.version" value="11"/> - <property name="build.java.version" value="17"/> + <property name="build.java.version" value="11"/> - <property name="release.java.version" value="22"/> + <property name="release.java.version" value="25"/> <!-- Check Java Build Version -->
