Re: Upgrade Apache- Tomcat and HTTPD

[Ivano Luberti]

Hi, Tomcat 8.5 still runs on JDK 1.7

Documentation about migration from one version to another can be found here:

https://tomcat.apache.org/migration.html


Il 21/10/2021 18:45, Kumawat, Priyanka ha scritto:

Hi Team ,

We have received some vulnerabilities for our Tomcat and Apache -httpd , as 
there multiple vulnerabilities reported we needs to upgrade the software.

Is there any documentation/process is available for the tomcat and Apache 
upgrade or any tool which we can use to perform the upgrade .

Also wat java version we will require for the Tomcat 8.0 and 8.5 version.

Thankyou!

Thanks & Regards,

Priyanka Kumawat | Middleware Admin
T +91.7879364483
EMail - priyanka.kuma...@dxc.com
DL - 
ams-leveraged-webadmin-offsh...@dxc.com

DXC Technology






DXC Technology Company -- This message is transmitted to you by or on behalf of 
DXC Technology Company or one of its affiliates. It is intended exclusively for 
the addressee. The substance of this message, along with any attachments, may 
contain proprietary, confidential or privileged information or information that 
is otherwise legally exempt from disclosure. Any unauthorized review, use, 
disclosure or distribution is prohibited. If you are not the intended recipient 
of this message, you are not authorized to read, print, retain, copy or 
disseminate any part of this message. If you have received this message in 
error, please destroy and delete all copies and notify the sender by return 
e-mail. Regardless of content, this e-mail shall not operate to bind DXC 
Technology Company or any of its affiliates to any order or other contract 
unless pursuant to explicit written agreement or government initiative 
expressly permitting the use of e-mail for such purpose.


--

Archimede Informatica tratta i dati personali in conformità a quanto
stabilito dal Regolamento UE n. 2016/679 (GDPR) e dal D. Lgs. 30 giugno 
2003 n. 196

per come modificato dal D.Lgs. 10 agosto 2018 n. 101.
Informativa completa 



dott. Ivano Mario Luberti

Archimede Informatica società cooperativa a r. l.
Via Gereschi 36, 56127 Pisa

tel.: +39 050/580959 | fax: +39 050/8932061

web: www.archicoop.it
linkedin: www.linkedin.com/in/ivanoluberti
facebook: www.facebook.com/archimedeinformaticapisa/

Upgrade Apache- Tomcat and HTTPD

[Kumawat, Priyanka]

Hi Team ,

We have received some vulnerabilities for our Tomcat and Apache -httpd , as 
there multiple vulnerabilities reported we needs to upgrade the software.

Is there any documentation/process is available for the tomcat and Apache 
upgrade or any tool which we can use to perform the upgrade .

Also wat java version we will require for the Tomcat 8.0 and 8.5 version.

Thankyou!

Thanks & Regards,

Priyanka Kumawat | Middleware Admin
T +91.7879364483
EMail - priyanka.kuma...@dxc.com
DL - 
ams-leveraged-webadmin-offsh...@dxc.com

DXC Technology






DXC Technology Company -- This message is transmitted to you by or on behalf of 
DXC Technology Company or one of its affiliates. It is intended exclusively for 
the addressee. The substance of this message, along with any attachments, may 
contain proprietary, confidential or privileged information or information that 
is otherwise legally exempt from disclosure. Any unauthorized review, use, 
disclosure or distribution is prohibited. If you are not the intended recipient 
of this message, you are not authorized to read, print, retain, copy or 
disseminate any part of this message. If you have received this message in 
error, please destroy and delete all copies and notify the sender by return 
e-mail. Regardless of content, this e-mail shall not operate to bind DXC 
Technology Company or any of its affiliates to any order or other contract 
unless pursuant to explicit written agreement or government initiative 
expressly permitting the use of e-mail for such purpose.

RE: Potential Memory Leak with StandardManager [EXTERNAL]

[Beard, Shawn]

There isn’t a memory leak I'm aware of. At least nothing is reported from what 
I can find. Have you tried setting maxActiveSessions? Its default is -1 which 
means infinite. Also there could be a bug in the code that is just creating new 
sessions for things instead of using the current session.

​
Shawn   Beard• Sr. Systems Engineer
Middleware Engineering
[cid:image498464.png@B1B8F0D2.A7934045]
3840 109th Street   ,   Urbandale   ,   IA  50322
Phone: +1-515-564-2528
Email:  sbe...@wrberkley.com
Website: https://berkleytechnologyservices.com/
[cid:image170342.jpg@8D7E010B.AF86CC81]
Technology Leadership Unleashing Business Potential


-Original Message-
From: Tim K 
Sent: Tuesday, October 19, 2021 6:35 AM
To: Tomcat Users List 
Subject: Re: Potential Memory Leak with StandardManager [EXTERNAL]

** CAUTION: External message


On Mon, Oct 18, 2021 at 2:51 PM Beard, Shawn 
wrote:

> Update to Tomcat 9.0.54. This could be a known security bug that is
> fixed in this version.
>
> https://urldefense.com/v3/__https://tomcat.apache.org/security-9.html*
> Fixed_in_Apache_Tomcat_9.0.54__;Iw!!Li8W9_Um1Taa!uj_ntV4p2gMeMsLvxyGG7
> 2U9DIPWfNyVeqRi0mD7H1ane3v6ToErlw4gMB9DVcrh$
>

I tried updating to that version but it does not appear to be related; that 
looks to be related to web socket connections.
CONFIDENTIALITY NOTICE: This e-mail and the transmitted documents contain 
private, privileged and confidential information belonging to the sender. The 
information therein is solely for the use of the addressee. If your receipt of 
this transmission has occurred as the result of an error, please immediately 
notify us so we can arrange for the return of the documents. In such 
circumstances, you are advised that you may not disclose, copy, distribute or 
take any other action in reliance on the information transmitted.

RE: xsd version used for web.xml etc

[S Abirami]

Thanks a lot Mark.

-Original Message-
From: Mark Thomas  
Sent: Thursday, October 21, 2021 4:23 PM
To: users@tomcat.apache.org
Subject: Re: xsd version used for web.xml etc

On 21/10/2021 10:37, S Abirami wrote:
> Hi Thomas,
> 
> How I can identify whether the schema validation enabled or not.
> I checked startup logs and other configuration.
> 
> I am unable to find it.

The quick test is to add an unknown element to web.xml and see what happens. If 
you get an error, validation is enabled. If it is ignored, validation is not 
enabled.

It is typically configured in $CATALINA_BASE/conf/context.xml

See https://tomcat.apache.org/tomcat-9.0-doc/config/context.html
Of particular interest:
xmlNamespaceAware
xmlValidation

Mark


> 
> Regards,
> Abirami.S
> 
> -Original Message-
> From: Mark Thomas 
> Sent: Thursday, October 21, 2021 2:40 PM
> To: users@tomcat.apache.org
> Subject: Re: xsd version used for web.xml etc
> 
> On 21/10/2021 09:45, S Abirami wrote:
>> Hi All,
>>
>> In web.xml, if we didn't define any xsd schema or dtd schema which version 
>> of xsd will be loaded for Tomcat 9.0.45.
> 
> By default none - whether a schema is defined or not. Schemas are only loaded 
> if validation is enabled.
> 
> With validation disabled, Tomcat will treat the content of a web.xml file as 
> if it is using the schema associated with the Servlet 4.0 specification.
> 
> Mark
> 
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
> 
> -
> To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
> For additional commands, e-mail: users-h...@tomcat.apache.org
> 


-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: xsd version used for web.xml etc

[Mark Thomas]

On 21/10/2021 10:37, S Abirami wrote:

Hi Thomas,

How I can identify whether the schema validation enabled or not.
I checked startup logs and other configuration.

I am unable to find it.


The quick test is to add an unknown element to web.xml and see what 
happens. If you get an error, validation is enabled. If it is ignored, 
validation is not enabled.


It is typically configured in $CATALINA_BASE/conf/context.xml

See https://tomcat.apache.org/tomcat-9.0-doc/config/context.html
Of particular interest:
xmlNamespaceAware
xmlValidation

Mark




Regards,
Abirami.S

-Original Message-
From: Mark Thomas 
Sent: Thursday, October 21, 2021 2:40 PM
To: users@tomcat.apache.org
Subject: Re: xsd version used for web.xml etc

On 21/10/2021 09:45, S Abirami wrote:

Hi All,

In web.xml, if we didn't define any xsd schema or dtd schema which version of 
xsd will be loaded for Tomcat 9.0.45.


By default none - whether a schema is defined or not. Schemas are only loaded 
if validation is enabled.

With validation disabled, Tomcat will treat the content of a web.xml file as if 
it is using the schema associated with the Servlet 4.0 specification.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org




-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: xsd version used for web.xml etc

[S Abirami]

Hi Thomas,

How I can identify whether the schema validation enabled or not.
I checked startup logs and other configuration.

I am unable to find it.

Regards,
Abirami.S

-Original Message-
From: Mark Thomas  
Sent: Thursday, October 21, 2021 2:40 PM
To: users@tomcat.apache.org
Subject: Re: xsd version used for web.xml etc

On 21/10/2021 09:45, S Abirami wrote:
> Hi All,
> 
> In web.xml, if we didn't define any xsd schema or dtd schema which version of 
> xsd will be loaded for Tomcat 9.0.45.

By default none - whether a schema is defined or not. Schemas are only loaded 
if validation is enabled.

With validation disabled, Tomcat will treat the content of a web.xml file as if 
it is using the schema associated with the Servlet 4.0 specification.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: xsd version used for web.xml etc

[S Abirami]

Thanks Thomas.

-Original Message-
From: Mark Thomas  
Sent: Thursday, October 21, 2021 2:40 PM
To: users@tomcat.apache.org
Subject: Re: xsd version used for web.xml etc

On 21/10/2021 09:45, S Abirami wrote:
> Hi All,
> 
> In web.xml, if we didn't define any xsd schema or dtd schema which version of 
> xsd will be loaded for Tomcat 9.0.45.

By default none - whether a schema is defined or not. Schemas are only loaded 
if validation is enabled.

With validation disabled, Tomcat will treat the content of a web.xml file as if 
it is using the schema associated with the Servlet 4.0 specification.

Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Re: xsd version used for web.xml etc

[Mark Thomas]

On 21/10/2021 09:45, S Abirami wrote:

Hi All,

In web.xml, if we didn't define any xsd schema or dtd schema which version of 
xsd will be loaded for Tomcat 9.0.45.


By default none - whether a schema is defined or not. Schemas are only 
loaded if validation is enabled.


With validation disabled, Tomcat will treat the content of a web.xml 
file as if it is using the schema associated with the Servlet 4.0 
specification.


Mark

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: xsd version used for web.xml etc

[S Abirami]

Hi All,

TOMCAT_BASE/conf/web.xml will be constructed by us during installation.

So that web.xml also will not have xsd definition.

Regards,
Abirami.S

-Original Message-
From: Jean-Pierre Urkens  
Sent: Thursday, October 21, 2021 2:25 PM
To: Tomcat Users List 
Subject: RE: xsd version used for web.xml etc

My guess, the one that is specified in TOMCAT_BASE/conf/web.xml

-Original Message-
From: S Abirami 
Sent: donderdag 21 oktober 2021 10:46
To: Tomcat Users List 
Subject: xsd version used for web.xml etc

Hi All,

In web.xml, if we didn't define any xsd schema or dtd schema which version of 
xsd will be loaded for Tomcat 9.0.45.

Regards,
Abirami.S

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

RE: xsd version used for web.xml etc

[Jean-Pierre Urkens]

My guess, the one that is specified in TOMCAT_BASE/conf/web.xml

-Original Message-
From: S Abirami 
Sent: donderdag 21 oktober 2021 10:46
To: Tomcat Users List 
Subject: xsd version used for web.xml etc

Hi All,

In web.xml, if we didn't define any xsd schema or dtd schema which version
of xsd will be loaded for Tomcat 9.0.45.

Regards,
Abirami.S

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

xsd version used for web.xml etc

[S Abirami]

Hi All,

In web.xml, if we didn't define any xsd schema or dtd schema which version of 
xsd will be loaded for Tomcat 9.0.45.

Regards,
Abirami.S