Modified: tomcat/site/trunk/docs/whoweare.html URL: http://svn.apache.org/viewvc/tomcat/site/trunk/docs/whoweare.html?rev=1856174&r1=1856173&r2=1856174&view=diff ============================================================================== --- tomcat/site/trunk/docs/whoweare.html (original) +++ tomcat/site/trunk/docs/whoweare.html Mon Mar 25 09:26:32 2019 @@ -1,223 +1,222 @@ <!DOCTYPE html SYSTEM "about:legacy-compat"> <html lang="en"> - <head> - <META http-equiv="Content-Type" content="text/html; charset=UTF-8"> - <meta name="viewport" content="width=device-width, initial-scale=1"> - <link href="res/css/tomcat.css" rel="stylesheet" type="text/css"> - <link href="res/css/fonts/fonts.css" rel="stylesheet" type="text/css"> - <title>Apache Tomcat® - Who We Are</title> - </head> - <body> - <div id="wrapper"> - <header id="header"> - <div class="clearfix"> - <div class="menu-toggler pull-left" tabindex="1"> - <div class="hamburger"></div> - </div> - <a href="http://tomcat.apache.org/";><img class="tomcat-logo pull-left noPrint" alt="Tomcat Home" src="res/images/tomcat.png"></a> - <h1 class="pull-left"> - Apache Tomcat<sup>®</sup> - </h1> - <div class="asf-logos pull-right"> - <a href="https://www.apache.org/foundation/contributing.html"; target="_blank" class="pull-left"><img src="https://www.apache.org/images/SupportApache-small.png"; class="support-asf" alt="Support Apache"></a><a href="http://www.apache.org/"; target="_blank" class="pull-left"><img src="res/images/asf_logo.svg" class="asf-logo" alt="The Apache Software Foundation"></a> - </div> - </div> - </header> - <main id="middle"> - <div> - <div id="mainLeft"> - <div id="nav-wrapper"> - <form action="https://www.google.com/search"; method="get"> - <div class="searchbox"> - <input value="tomcat.apache.org" name="sitesearch" type="hidden"><input placeholder="Search…" required="required" name="q" id="query" type="search"><button>GO</button> - </div> - </form> - <nav> - <div> - <h2>Apache Tomcat</h2> - <ul> - <li> - <a href="./index.html">Home</a> - </li> - <li> - <a href="./taglibs.html">Taglibs</a> - </li> - <li> - <a href="./maven-plugin.html">Maven Plugin</a> - </li> - </ul> - </div> - <div> - <h2>Download</h2> - <ul> - <li> - <a href="./whichversion.html">Which version?</a> - </li> - <li> - <a href="https://tomcat.apache.org/download-90.cgi";>Tomcat 9</a> - </li> - <li> - <a href="https://tomcat.apache.org/download-80.cgi";>Tomcat 8</a> - </li> - <li> - <a href="https://tomcat.apache.org/download-70.cgi";>Tomcat 7</a> - </li> - <li> - <a href="https://tomcat.apache.org/download-connectors.cgi";>Tomcat Connectors</a> - </li> - <li> - <a href="https://tomcat.apache.org/download-native.cgi";>Tomcat Native</a> - </li> - <li> - <a href="https://tomcat.apache.org/download-taglibs.cgi";>Taglibs</a> - </li> - <li> - <a href="https://archive.apache.org/dist/tomcat/";>Archives</a> - </li> - </ul> - </div> - <div> - <h2>Documentation</h2> - <ul> - <li> - <a href="./tomcat-9.0-doc/index.html">Tomcat 9.0</a> - </li> - <li> - <a href="./tomcat-8.5-doc/index.html">Tomcat 8.5</a> - </li> - <li> - <a href="./tomcat-7.0-doc/index.html">Tomcat 7.0</a> - </li> - <li> - <a href="./connectors-doc/">Tomcat Connectors</a> - </li> - <li> - <a href="./native-doc/">Tomcat Native</a> - </li> - <li> - <a href="https://wiki.apache.org/tomcat/FrontPage";>Wiki</a> - </li> - <li> - <a href="./migration.html">Migration Guide</a> - </li> - <li> - <a href="./presentations.html">Presentations</a> - </li> - </ul> - </div> - <div> - <h2>Problems?</h2> - <ul> - <li> - <a href="./security.html">Security Reports</a> - </li> - <li> - <a href="./findhelp.html">Find help</a> - </li> - <li> - <a href="https://wiki.apache.org/tomcat/FAQ";>FAQ</a> - </li> - <li> - <a href="./lists.html">Mailing Lists</a> - </li> - <li> - <a href="./bugreport.html">Bug Database</a> - </li> - <li> - <a href="./irc.html">IRC</a> - </li> - </ul> - </div> - <div> - <h2>Get Involved</h2> - <ul> - <li> - <a href="./getinvolved.html">Overview</a> - </li> - <li> - <a href="./source.html">Source code</a> - </li> - <li> - <a href="./ci.html">Buildbot</a> - </li> - <li> - <a href="./tools.html">Tools</a> - </li> - </ul> - </div> - <div> - <h2>Media</h2> - <ul> - <li> - <a href="https://twitter.com/theapachetomcat";>Twitter</a> - </li> - <li> - <a href="https://www.youtube.com/c/ApacheTomcatOfficial";>YouTube</a> - </li> - <li> - <a href="https://blogs.apache.org/tomcat/";>Blog</a> - </li> - </ul> - </div> - <div> - <h2>Misc</h2> - <ul> - <li> - <a href="./whoweare.html">Who We Are</a> - </li> - <li> - <a href="https://www.redbubble.com/people/comdev/works/30885254-apache-tomcat";>Swag</a> - </li> - <li> - <a href="./heritage.html">Heritage</a> - </li> - <li> - <a href="http://www.apache.org";>Apache Home</a> - </li> - <li> - <a href="./resources.html">Resources</a> - </li> - <li> - <a href="./contact.html">Contact</a> - </li> - <li> - <a href="./legal.html">Legal</a> - </li> - <li> - <a href="https://www.apache.org/foundation/contributing.html";>Support Apache</a> - </li> - <li> - <a href="https://www.apache.org/foundation/sponsorship.html";>Sponsorship</a> - </li> - <li> - <a href="http://www.apache.org/foundation/thanks.html";>Thanks</a> - </li> - <li> - <a href="http://www.apache.org/licenses/";>License</a> - </li> - </ul> - </div> - </nav> - </div> - </div> - <div id="mainRight"> - <div id="content"> - <h2 style="display: none;">Content</h2> - <h3 id="Who_We_Are">Who We Are</h3> - <div class="text"> - - <p> - The Apache Tomcat Project operates on a meritocracy: the more you do, +<head> +<META http-equiv="Content-Type" content="text/html; charset=UTF-8"> +<meta name="viewport" content="width=device-width, initial-scale=1"> +<link href="res/css/tomcat.css" rel="stylesheet" type="text/css"> +<link href="res/css/fonts/fonts.css" rel="stylesheet" type="text/css"> +<title>Apache Tomcat® - Who We Are</title> +</head> +<body> +<div id="wrapper"> +<header id="header"> +<div class="clearfix"> +<div class="menu-toggler pull-left" tabindex="1"> +<div class="hamburger"></div> +</div> +<a href="http://tomcat.apache.org/";><img class="tomcat-logo pull-left noPrint" alt="Tomcat Home" src="res/images/tomcat.png"></a> +<h1 class="pull-left">Apache Tomcat<sup>®</sup> +</h1> +<div class="asf-logos pull-right"> +<a href="https://www.apache.org/foundation/contributing.html"; target="_blank" class="pull-left"><img src="https://www.apache.org/images/SupportApache-small.png"; class="support-asf" alt="Support Apache"></a><a href="http://www.apache.org/"; target="_blank" class="pull-left"><img src="res/images/asf_logo.svg" class="asf-logo" alt="The Apache Software Foundation"></a> +</div> +</div> +</header> +<main id="middle"> +<div> +<div id="mainLeft"> +<div id="nav-wrapper"> +<form action="https://www.google.com/search"; method="get"> +<div class="searchbox"> +<input value="tomcat.apache.org" name="sitesearch" type="hidden"><input placeholder="Search…" required="required" name="q" id="query" type="search"><button>GO</button> +</div> +</form> +<nav> +<div> +<h2>Apache Tomcat</h2> +<ul> +<li> +<a href="./index.html">Home</a> +</li> +<li> +<a href="./taglibs.html">Taglibs</a> +</li> +<li> +<a href="./maven-plugin.html">Maven Plugin</a> +</li> +</ul> +</div> +<div> +<h2>Download</h2> +<ul> +<li> +<a href="./whichversion.html">Which version?</a> +</li> +<li> +<a href="https://tomcat.apache.org/download-90.cgi";>Tomcat 9</a> +</li> +<li> +<a href="https://tomcat.apache.org/download-80.cgi";>Tomcat 8</a> +</li> +<li> +<a href="https://tomcat.apache.org/download-70.cgi";>Tomcat 7</a> +</li> +<li> +<a href="https://tomcat.apache.org/download-connectors.cgi";>Tomcat Connectors</a> +</li> +<li> +<a href="https://tomcat.apache.org/download-native.cgi";>Tomcat Native</a> +</li> +<li> +<a href="https://tomcat.apache.org/download-taglibs.cgi";>Taglibs</a> +</li> +<li> +<a href="https://archive.apache.org/dist/tomcat/";>Archives</a> +</li> +</ul> +</div> +<div> +<h2>Documentation</h2> +<ul> +<li> +<a href="./tomcat-9.0-doc/index.html">Tomcat 9.0</a> +</li> +<li> +<a href="./tomcat-8.5-doc/index.html">Tomcat 8.5</a> +</li> +<li> +<a href="./tomcat-7.0-doc/index.html">Tomcat 7.0</a> +</li> +<li> +<a href="./connectors-doc/">Tomcat Connectors</a> +</li> +<li> +<a href="./native-doc/">Tomcat Native</a> +</li> +<li> +<a href="https://wiki.apache.org/tomcat/FrontPage";>Wiki</a> +</li> +<li> +<a href="./migration.html">Migration Guide</a> +</li> +<li> +<a href="./presentations.html">Presentations</a> +</li> +</ul> +</div> +<div> +<h2>Problems?</h2> +<ul> +<li> +<a href="./security.html">Security Reports</a> +</li> +<li> +<a href="./findhelp.html">Find help</a> +</li> +<li> +<a href="https://wiki.apache.org/tomcat/FAQ";>FAQ</a> +</li> +<li> +<a href="./lists.html">Mailing Lists</a> +</li> +<li> +<a href="./bugreport.html">Bug Database</a> +</li> +<li> +<a href="./irc.html">IRC</a> +</li> +</ul> +</div> +<div> +<h2>Get Involved</h2> +<ul> +<li> +<a href="./getinvolved.html">Overview</a> +</li> +<li> +<a href="./source.html">Source code</a> +</li> +<li> +<a href="./ci.html">Buildbot</a> +</li> +<li> +<a href="./tools.html">Tools</a> +</li> +</ul> +</div> +<div> +<h2>Media</h2> +<ul> +<li> +<a href="https://twitter.com/theapachetomcat";>Twitter</a> +</li> +<li> +<a href="https://www.youtube.com/c/ApacheTomcatOfficial";>YouTube</a> +</li> +<li> +<a href="https://blogs.apache.org/tomcat/";>Blog</a> +</li> +</ul> +</div> +<div> +<h2>Misc</h2> +<ul> +<li> +<a href="./whoweare.html">Who We Are</a> +</li> +<li> +<a href="https://www.redbubble.com/people/comdev/works/30885254-apache-tomcat";>Swag</a> +</li> +<li> +<a href="./heritage.html">Heritage</a> +</li> +<li> +<a href="http://www.apache.org";>Apache Home</a> +</li> +<li> +<a href="./resources.html">Resources</a> +</li> +<li> +<a href="./contact.html">Contact</a> +</li> +<li> +<a href="./legal.html">Legal</a> +</li> +<li> +<a href="https://www.apache.org/foundation/contributing.html";>Support Apache</a> +</li> +<li> +<a href="https://www.apache.org/foundation/sponsorship.html";>Sponsorship</a> +</li> +<li> +<a href="http://www.apache.org/foundation/thanks.html";>Thanks</a> +</li> +<li> +<a href="http://www.apache.org/licenses/";>License</a> +</li> +</ul> +</div> +</nav> +</div> +</div> +<div id="mainRight"> +<div id="content"> +<h2 style="display: none;">Content</h2> +<h3 id="Who_We_Are">Who We Are</h3> +<div class="text"> + +<p> +The Apache Tomcat Project operates on a meritocracy: the more you do, the more responsibility you will obtain. This page lists all of the people who have gone the extra mile and are Committers or members of the Project Management Committee (PMC). If you would like to help, please see the overview on <a href="getinvolved.html">getting involved</a>. +</p> + - </p> - - <p> - We ask that you please do not send us emails privately asking for support. We +<p> +We ask that you please do not send us emails privately asking for support. We are non-paid volunteers who help out with the project and we do not necessarily have the time or energy to help people on an individual basis. Instead, we have setup <a href="./lists.html">mailing @@ -225,231 +224,271 @@ lists</a> which contain hundreds of indi detailed requests for help. The benefit of using mailing lists over private communication is that it is a shared resource where others can also learn from common mistakes and as a community we all grow together. +</p> + - </p> - - <p> +<p> The following is a list of the Apache Tomcat PMC members and Committers with short bios for some of them.</p> - - <p> - A complete list of all the Apache Committers is + + +<p> +A complete list of all the Apache Committers is <a href="http://people.apache.org/committer-index.html";>also available</a>. (It's a long list, so please be patient.) +</p> + + +</div> +<h3 id="PMC_Members_&_Committers">PMC Members & Committers</h3> +<div class="text"> + + +<h4>PMC Chair</h4> + +<p> +<b>Mladen Turk</b> (mturk at apache.org)<br> +</p> + + + +<h4>PMC Members & Committers</h4> + + +<p> +<b>Jean-Francois Arcand</b> (jfarcand at apache.org)<br> +</p> + + + +<p> +<b>Bill Barker</b> (billbarker at apache.org)<br> +</p> + + + +<p> +<b>Ognjen BlagojeviÄ</b> (ognjen at apache.org)<br> +</p> + + + +<p> +<b>Emmanuel Bourg</b> (ebourg at apache.org)<br> +</p> + + + +<p> +<b>Jeremy Boynes</b> (jboynes at apache.org)<br> +</p> + + + +<p> +<b>Jean-Frederic Clere</b> (jfclere at apache.org)<br> +</p> + + + +<p> +<b>Keiichi Fujino</b> (kfujino at apache.org)<br> +</p> + + + + +<p> +<b>Tim Funk</b> (funkman at apache.org)<br> +</p> + + + +<p> +<b>Violeta Georgieva</b> (violetagg at apache.org)<br> +</p> + + + +<p> +<b>Henri Gomez</b> (hgomez at apache.org)<br> +</p> + + + +<p> +<b>Martin Grigorov</b> (mgrigorov at apache.org)<br> +</p> + + + +<p> +<b>Filip Hanik</b> (fhanik at apache.org)<br> +</p> + + + +<p> +<b>Jacob Hookom</b> (jhook at apache.org)<br> +</p> + + + +<p> +<b>Jim Jagielski</b> (jim at apache.org)<br> +</p> + + + +<p> +<b>Rainer Jung</b> (rjung at apache.org)<br> +</p> + + + +<p> +<b>Konstantin Kolinko</b> (kkolinko at apache.org)<br> +</p> + + + +<p> +<b>Olivier Lamy</b> (olamy at apache.org)<br> +</p> + - </p> - - </div> - <h3 id="PMC_Members_&_Committers">PMC Members & Committers</h3> - <div class="text"> - - <h4>PMC Chair</h4> - - <p> - <b>Mladen Turk</b> (mturk at apache.org) - <br> - </p> - - <h4>PMC Members & Committers</h4> - - <p> - <b>Jean-Francois Arcand</b> (jfarcand at apache.org) - <br> - </p> - - <p> - <b>Bill Barker</b> (billbarker at apache.org) - <br> - </p> - - <p> - <b>Ognjen BlagojeviÄ</b> (ognjen at apache.org) - <br> - </p> - - <p> - <b>Emmanuel Bourg</b> (ebourg at apache.org) - <br> - </p> - - <p> - <b>Jeremy Boynes</b> (jboynes at apache.org) - <br> - </p> - - <p> - <b>Jean-Frederic Clere</b> (jfclere at apache.org) - <br> - </p> - - <p> - <b>Keiichi Fujino</b> (kfujino at apache.org) - <br> - </p> - - <p> - <b>Tim Funk</b> (funkman at apache.org) - <br> - </p> - - <p> - <b>Violeta Georgieva</b> (violetagg at apache.org) - <br> - </p> - - <p> - <b>Henri Gomez</b> (hgomez at apache.org) - <br> - </p> - - <p> - <b>Martin Grigorov</b> (mgrigorov at apache.org) - <br> - </p> - - <p> - <b>Filip Hanik</b> (fhanik at apache.org) - <br> - </p> - - <p> - <b>Jacob Hookom</b> (jhook at apache.org) - <br> - </p> - - <p> - <b>Jim Jagielski</b> (jim at apache.org) - <br> - </p> - - <p> - <b>Rainer Jung</b> (rjung at apache.org) - <br> - </p> - - <p> - <b>Konstantin Kolinko</b> (kkolinko at apache.org) - <br> - </p> - - <p> - <b>Olivier Lamy</b> (olamy at apache.org) - <br> - </p> - - <p> - <b>Sylvain Laurent</b> (slaurent at apache.org) - <br> - </p> - - <p> - <b>Remy Maucherat</b> (remm at apache.org) - <br> - </p> - - <p> - <b>Costin Manolache</b> (costin at apache.org) - <br> - </p> - - <p> - <b>Konstantin Preißer</b> (kpreisser at apache.org) - <br> - </p> - - <p> - <b>Peter Rossbach</b> (pero at apache.org) - <br> - </p> - - <p> - <b>William A. Rowe Jr.</b> (wrowe at apache.org) - <br> - </p> - - <p> - <b>Igal Sapir</b> (isapir at apache.org) - <br> - </p> - - <p> - <b>Christopher Schultz</b> (schultz at apache.org) - <br> - </p> - - <p> - <b>Felix Schumacher</b> (fschumacher at apache.org) - <br> - </p> - - <p> - <b>Coty Sutherland</b> (csutherl at apache.org) - <br> - </p> - - <p> - <b>Eiji Takahashi</b> (eijit at apache.org) - <br> - </p> - - <p> - <b>Mark Thomas</b> (markt at apache.org) - <br> - </p> - - <p> - <b>Keith Wannamaker</b> (keith at apache.org) - <br> - </p> - - <p> - <b>André Warnier</b> (soliplaya at apache.org) - <br> - </p> - - <p> - <b>Tim Whittington</b> (timw at apache.org) - <br> - </p> - - <p> - <b>Huxing Zhang</b> (huxing at apache.org) - <br> - </p> - - </div> - <h3 id="Emeritus_PMC_members">Emeritus PMC members</h3> - <div class="text"> - - <p> - <a href="http://www.apache.org/foundation/glossary.html#Emeritus";> -Emeritus</a> is defined in the Apache glossary. - </p> - - <p> - - <p> - <b>Ian Darwin</b> (idarwin at apache.org) - </p> - - </p> - - <p> - <b>Yoav Shapira</b> (yoavs at apache.org) - </p> - - </div> - <h3 id="Emeritus_Committers">Emeritus Committers</h3> - <div class="text"> - - <p> - <a href="http://www.apache.org/foundation/glossary.html#Emeritus";> -Emeritus</a> is defined in the Apache glossary. - </p> - - <p> - - <b>James Duncan Davidson</b> (duncan at apache.org), + +<p> +<b>Sylvain Laurent</b> (slaurent at apache.org)<br> +</p> + + + +<p> +<b>Remy Maucherat</b> (remm at apache.org)<br> +</p> + + + +<p> +<b>Costin Manolache</b> (costin at apache.org)<br> +</p> + + + +<p> +<b>Konstantin Preißer</b> (kpreisser at apache.org)<br> +</p> + + + +<p> +<b>Peter Rossbach</b> (pero at apache.org)<br> +</p> + + + +<p> +<b>William A. Rowe Jr.</b> (wrowe at apache.org)<br> +</p> + + + +<p> +<b>Igal Sapir</b> (isapir at apache.org)<br> +</p> + + + +<p> +<b>Christopher Schultz</b> (schultz at apache.org)<br> +</p> + + + +<p> +<b>Felix Schumacher</b> (fschumacher at apache.org)<br> +</p> + + + +<p> +<b>Coty Sutherland</b> (csutherl at apache.org)<br> +</p> + + + +<p> +<b>Eiji Takahashi</b> (eijit at apache.org)<br> +</p> + + + +<p> +<b>Mark Thomas</b> (markt at apache.org)<br> +</p> + + + +<p> +<b>Keith Wannamaker</b> (keith at apache.org)<br> +</p> + + + +<p> +<b>André Warnier</b> (soliplaya at apache.org)<br> +</p> + + + +<p> +<b>Tim Whittington</b> (timw at apache.org)<br> +</p> + + + +<p> +<b>Huxing Zhang</b> (huxing at apache.org)<br> +</p> + + +</div> +<h3 id="Emeritus_PMC_members">Emeritus PMC members</h3> +<div class="text"> + + +<p> +<a href="http://www.apache.org/foundation/glossary.html#Emeritus";> +Emeritus</a> is defined in the Apache glossary.</p> + + +<p> + +<p> +<b>Ian Darwin</b> (idarwin at apache.org)</p> + +</p> + + +<p> +<b>Yoav Shapira</b> (yoavs at apache.org)</p> + + + +</div> +<h3 id="Emeritus_Committers">Emeritus Committers</h3> +<div class="text"> + + +<p> +<a href="http://www.apache.org/foundation/glossary.html#Emeritus";> +Emeritus</a> is defined in the Apache glossary.</p> + + +<p> + +<b>James Duncan Davidson</b> (duncan at apache.org), <b>Jon Scott Stevens</b> (jon at apache.org), <b>Sam Ruby</b> (rubys at apache.org), <b>Anil Vijendran</b> (akv at apache.org), @@ -500,24 +539,22 @@ Emeritus</a> is defined in the Apache gl <b>Keith Eric Carmichael</b> (ecarmich at apache.org), <b>Guenter Knauf</b> (fuankg at apache.org), <b>Jean-Jacques Clar</b> (clar at apache.org), +</p> + - </p> - - </div> - </div> - </div> - </div> - </main> - <footer id="footer"> - Copyright © 1999-2019, The Apache Software Foundation - - <br> - Apache Tomcat, Tomcat, Apache, the Apache feather, and the Apache Tomcat +</div> +</div> +</div> +</div> +</main> +<footer id="footer"> + Copyright © 1999-2019, The Apache Software Foundation + <br> + Apache Tomcat, Tomcat, Apache, the Apache feather, and the Apache Tomcat project logo are either registered trademarks or trademarks of the Apache Software Foundation. - - </footer> - </div> - <script src="res/js/tomcat.js"></script> - </body> + </footer> +</div> +<script src="res/js/tomcat.js"></script> +</body> </html>
Modified: tomcat/site/trunk/xdocs/security-8.xml URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-8.xml?rev=1856174&r1=1856173&r2=1856174&view=diff ============================================================================== --- tomcat/site/trunk/xdocs/security-8.xml (original) +++ tomcat/site/trunk/xdocs/security-8.xml Mon Mar 25 09:26:32 2019 @@ -50,6 +50,41 @@ </section> + <section name="Fixed in Apache Tomcat 8.5.38" rtext="8 February 2019"> + + <p><strong>Important: Denial of Service</strong> + <cve>CVE-2019-0199</cve></p> + + <p>The HTTP/2 implementation accepted streams with excessive numbers of + <code>SETTINGS</code> frames and also permitted clients to keep streams + open without reading/writing request/response data. By keeping streams + open for requests that utilised the Servlet API's blocking I/O, clients + were able to cause server-side threads to block eventually leading to + thread exhaustion and a DoS.</p> + + <p>This was fixed in revisions <revlink rev="1852707">1852707</revlink>, + <revlink rev="1852711">1852711</revlink>, + <revlink rev="1852712">1852712</revlink>, + <revlink rev="1852713">1852713</revlink>, + <revlink rev="1852714">1852714</revlink>, + <revlink rev="1852715">1852715</revlink>, + <revlink rev="1852717">1852717</revlink>, + <revlink rev="1852718">1852718</revlink>, + <revlink rev="1852719">1852719</revlink>, + <revlink rev="1852722">1852722</revlink>, + <revlink rev="1852723">1852723</revlink>, + <revlink rev="1852724">1852724</revlink> and + <hashlink hash="60a3af1">60a3af1</hashlink>.</p> + + <p>This issue was reported to the Apache Tomcat Security Team by Michal Karm + Babacek from Red Hat, Inc on 4 January 2019 with additional issues + identified by the Tomcat Security Team. The issue was made public on 25 + March 2019.</p> + + <p>Affects: 8.5.0 to 8.5.37</p> + + </section> + <section name="Fixed in Apache Tomcat 8.5.34" rtext="10 September 2018"> <p><strong>Moderate: Open Redirect</strong> Modified: tomcat/site/trunk/xdocs/security-9.xml URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/security-9.xml?rev=1856174&r1=1856173&r2=1856174&view=diff ============================================================================== --- tomcat/site/trunk/xdocs/security-9.xml (original) +++ tomcat/site/trunk/xdocs/security-9.xml Mon Mar 25 09:26:32 2019 @@ -50,6 +50,44 @@ </section> + <section name="Fixed in Apache Tomcat 9.0.16" rtext="8 February 2019"> + + <p><i>Note: The issue below was fixed in Apache Tomcat 9.0.15 but the + release vote for the 9.0.15 release candidate did not pass. Therefore, + although users must download 9.0.16 to obtain a version that includes a + fix for these issues, version 9.0.15 is not included in the list of + affected versions.</i></p> + + <p><strong>Important: Denial of Service</strong> + <cve>CVE-2019-0199</cve></p> + + <p>The HTTP/2 implementation accepted streams with excessive numbers of + <code>SETTINGS</code> frames and also permitted clients to keep streams + open without reading/writing request/response data. By keeping streams + open for requests that utilised the Servlet API's blocking I/O, clients + were able to cause server-side threads to block eventually leading to + thread exhaustion and a DoS.</p> + + <p>This was fixed in revisions <revlink rev="1852698">1852698</revlink>, + <revlink rev="1852699">1852699</revlink>, + <revlink rev="1852700">1852700</revlink>, + <revlink rev="1852701">1852701</revlink>, + <revlink rev="1852702">1852702</revlink>, + <revlink rev="1852703">1852703</revlink>, + <revlink rev="1852704">1852704</revlink>, + <revlink rev="1852705">1852705</revlink>, + <revlink rev="1852706">1852706</revlink> and + <hashlink hash="a1cb1ac">a1cb1ac</hashlink>.</p> + + <p>This issue was reported to the Apache Tomcat Security Team by Michal Karm + Babacek from Red Hat, Inc on 4 January 2019 with additional issues + identified by the Tomcat Security Team. The issue was made public on 25 + March 2019.</p> + + <p>Affects: 9.0.0.M1 to 9.0.14</p> + + </section> + <section name="Fixed in Apache Tomcat 9.0.12" rtext="10 September 2018"> <p><strong>Moderate: Open Redirect</strong> @@ -107,7 +145,7 @@ <p>Affects: 9.0.0.M9 to 9.0.9</p> </section> - <section name="Fixed in Apache Tomcat 9.0.9" rtext="not yet released"> + <section name="Fixed in Apache Tomcat 9.0.9" rtext="not released"> <p><strong>Low: CORS filter has insecure defaults</strong> <cve>CVE-2018-8014</cve></p> Modified: tomcat/site/trunk/xdocs/stylesheets/tomcat-site.xsl URL: http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/stylesheets/tomcat-site.xsl?rev=1856174&r1=1856173&r2=1856174&view=diff ============================================================================== --- tomcat/site/trunk/xdocs/stylesheets/tomcat-site.xsl (original) +++ tomcat/site/trunk/xdocs/stylesheets/tomcat-site.xsl Mon Mar 25 09:26:32 2019 @@ -34,7 +34,8 @@ <xsl:param name="home-logo" select="'res/images/tomcat.png'"/> <xsl:param name="asf-logo" select="'res/images/asf_logo.svg'"/> <xsl:param name="buglink" select="'https://bz.apache.org/bugzilla/show_bug.cgi?id='"/> - <xsl:param name="revlink" select="'http://svn.apache.org/viewvc?view=rev&rev='"/> + <xsl:param name="revlink" select="'https://svn.apache.org/viewvc?view=rev&rev='"/> + <xsl:param name="hashlink" select="'https://github.com/apache/tomcat/commit/'"/> <xsl:param name="cvelink" select="'http://cve.mitre.org/cgi-bin/cvename.cgi?name='"/> <!-- Defined variables (non-overrideable) --> @@ -342,12 +343,18 @@ </xsl:template> <!-- Link to a SVN revision report --> - <!-- It is similat to <rev> tag, but allows arbitrary text inside --> + <!-- It is similar to <rev> tag, but allows arbitrary text inside --> <xsl:template match="revlink"> <xsl:variable name="link"><xsl:value-of select="$revlink"/><xsl:value-of select="@rev"/></xsl:variable> <a href="{$link}"><xsl:apply-templates/></a> </xsl:template> + <!-- Link to a git hash --> + <xsl:template match="hashlink"> + <xsl:variable name="link"><xsl:value-of select="$hashlink"/><xsl:value-of select="@hash"/></xsl:variable> + <a href="{$link}"><xsl:apply-templates/></a> + </xsl:template> + <!-- Link to a CVE report --> <xsl:template match="cve"> <xsl:variable name="link"><xsl:value-of select="$cvelink"/><xsl:value-of select="text()"/></xsl:variable> --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
![https://www.apache.org/images/SupportApache-small.png"](https://www.apache.org/images/SupportApache-small.png"){kind=link}