[ANN] Apache Tomcat 8.5.65 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.65. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and Java Authentication Service Provider Interface for Containers

[ANN] Apache Tomcat Native 1.2.28 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat Native 1.2.28 stable. The key features of this release are: - Windows binaries built using 1.1.1k - Correct a regression in the fix for 65181 that prevented an error message from being displayed if an invalid key file

[ANN] Apache Tomcat Migration tool for Jakarta EE 1.0.0

The Apache Tomcat team announces the immediate availability of Apache Tomcat Migration Tool for Jakarta EE 1.0.0 Apache Tomcat Migration Tool for Jakarta EE is an open source software tool for migrating binary web applications (WAR files) and other binary artefacts from Java EE 8 to Jakarta EE 9.

[ANN] Apache Tomcat 10.0.6 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 10.0.6. This release is targeted at Jakarta EE 9. Applications that run on Tomcat 9 and earlier will not run on Tomcat 10 without changes. Java EE applications designed for Tomcat 9 and earlier may be placed in the $C

[ANN] Apache Tomcat 9.0.46 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.46. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.46 is a bugfix and fea

[ANN] Apache Tomcat 8.5.66 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.66. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and Java Authentication Service Provider Interface for Containers

[ANN] Apache Tomcat Native 1.2.30 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat Native 1.2.30 stable. The key features of this release are: - Windows binaries built using OpenSSL 1.1.1k - Fix an issue where some Windows systems in some configurations would only listen on IPv6 addresses on dual st

[ANN] Apache Tomcat 10.1.0-M1 (alpha) available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 10.1.0-M1. Apache Tomcat 10 is an open source software implementation of the Jakarta Servlet, Jakarta Server Pages, Jakarta Expression Language, Jakarta WebSocket, Jakarta Authentication and Jakarta Annotations specifica

[ANN] Apache Tomcat 10.1.0-M2 (alpha) available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 10.1.0-M2. Apache Tomcat 10 is an open source software implementation of the Jakarta Servlet, Jakarta Server Pages, Jakarta Expression Language, Jakarta WebSocket, Jakarta Authentication and Jakarta Annotations specifica

[ANN] Apache Tomcat 10.0.8 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 10.0.8. This release is targeted at Jakarta EE 9. Applications that run on Tomcat 9 and earlier will not run on Tomcat 10 without changes. Java EE applications designed for Tomcat 9 and earlier may be placed in the $C

[SECURITY] CVE-2021-30639 Apache Tomcat DoS

CVE-2021-30639 Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 10.0.3 to 10.0.4 Apache Tomcat 9.0.44 Apache Tomcat 8.5.64 Description: An error introduced as part of a change to improve error handling during non-blocking I/O meant

[SECURITY] CVE-2021-30640 Apache Tomcat JNDI realm authentication weakness

CVE-2021-30640 JNDI Realm Authentication Weakness Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 10.0.0-M1 to 10.0.5 Apache Tomcat 9.0.0.M1 to 9.0.45 Apache Tomcat 8.5.0 to 8.5.65 Apache Tomcat 7.0.0 to 7.0.108 Description: Queries made by the JNDI Realm

[SECURITY] CVE-2021-33037 Apache Tomcat HTTP request smuggling

CVE-2021-33037 HTTP request smuggling Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 10.0.0-M1 to 10.0.6 Apache Tomcat 9.0.0.M1 to 9.0.46 Apache Tomcat 8.5.0 to 8.5.66 Description: Apache Tomcat did not correctly parse the HTTP transfer-encoding req

[ANN] Apache Tomcat 10.0.10 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 10.0.10. This release is targeted at Jakarta EE 9. Applications that run on Tomcat 9 and earlier will not run on Tomcat 10 without changes. Java EE applications designed for Tomcat 9 and earlier may be placed in the $

[ANN] Apache Tomcat 10.1.0-M4 (alpha) available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 10.1.0-M4 (alpha). Apache Tomcat 10 is an open source software implementation of the Jakarta Servlet, Jakarta Server Pages, Jakarta Expression Language, Jakarta WebSocket, Jakarta Authentication and Jakarta Annotations s

[ANN] Apache Tomcat 8.5.70 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.70. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and Java Authentication Service Provider Interface for Containers

[ANN] Apache Tomcat Native 1.2.31 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat Native 1.2.31 stable. The key features of this release are: - Windows binaries built using OpenSSL 1.1.1l - Fix an issue when building with OpenSSl 3.0.0 Please refer to the change log for the complete list of changes:

[ANN] Apache Tomcat 10.1.0-M5 (alpha) available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 10.1.0-M5 (alpha). Apache Tomcat 10 is an open source software implementation of the Jakarta Servlet, Jakarta Server Pages, Jakarta Expression Language, Jakarta WebSocket, Jakarta Authentication and Jakarta Annotations s

[ANN] Apache Tomcat 10.0.11 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 10.0.11. This release is targeted at Jakarta EE 9. Applications that run on Tomcat 9 and earlier will not run on Tomcat 10 without changes. Java EE applications designed for Tomcat 9 and earlier may be placed in the $

[SECURITY] CVE-2021-41079 Apache Tomcat DoS

CVE-2021-41079 Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 10.0.0-M1 to 10.0.2 Apache Tomcat 9.0.0-M1 to 9.0.43 Apache Tomcat 8.5.0 to 8.5.63 Description: When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a

[ANN] Apache Tomcat 4.1.34 is voted stable

The Apache Tomcat team is proud to announce the immediate availability of Tomcat 4.1.34 stable. This build contains numerous bug fixes, documentation updates, and other improvements. Apache Tomcat is an implementation of the Java Server Pages 1.2 and Java Servlet 2.3 specifications. Please refer

[ANN] Apache Tomcat 4.1.36 stable is released

The Apache Tomcat team is proud to announce the immediate availability of Tomcat 4.1.36 stable. This build contains numerous library updates, a small number of bug fixes and two important security fixes. Apache Tomcat is an implementation of the Java Server Pages 1.2 and Java Servlet 2.3 specifica

[ANN] Apache Tomcat 4.1.37 stable is released

The Apache Tomcat team is proud to announce the immediate availability of Tomcat 4.1.37 stable. This build contains numerous library updates, a small number of bug fixes and two important, one moderate and six low severity security fixes. Apache Tomcat is an implementation of the Java Server Page

[ANN] Apache Tomcat 4.1.39 stable is released

The Apache Tomcat team is proud to announce the immediate availability of Tomcat 4.1.39 stable. This build contains a small number of bug fixes and two important, one moderate and one low severity security fixes. Apache Tomcat is an implementation of the Java Server Pages 1.2 and Java Servlet 2.3

[SECURITY] CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerability

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Vulnerability announcement: CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerability Severity: important Vendor: The Apache Software Foundation Versions Affected: mod_jk 1.2.0 to 1.2.26 Description: Situations where faulty clients s

[ANN] Apache Tomcat 4.1.40 stable is now available

The Apache Tomcat team is proud to announce the immediate availability of Tomcat 4.1.40 stable. This build contains a small number of bug fixes and two important and three low severity security fixes. Please refer to the release notes for a complete list of changes. Apache Tomcat 4 is an implemen

[Fwd: [ANN] Apache Tomcat 5.5.28 released]

The Apache Tomcat team announces the immediate availability of Apache Tomcat 5.5.28 stable. Apache Tomcat 5.5.28 incorporates numerous security updates and bug fixes. Please refer to the change log for the list of changes: http://tomcat.apache.org/tomcat-5.5-doc/changelog.html Downloads: http://t

[SECURITY] CVE-2009-2901 Apache Tomcat insecure partial deploy after failed undeploy

ensuring that an undeploy removes all files. If one or more files cannot be deleted, it may be necessary to stop Tomcat before the files can be deleted. Credit: This issue was discovered by the Apache Tomcat security team References: [1] http://tomcat.apache.org/security.html Mark Thomas -

[SECURITY] CVE-2009-2902 Apache Tomcat unexpected file deletion in work directory

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2009-2902: Apache Tomcat unexpected file deletion in work directory Severity: Low Vendor: The Apache Software Foundation Versions Affected: Tomcat 5.5.0 to 5.5.28 Tomcat 6.0.0 to 6.0.20 The unsupported Tomcat 3.x, 4.x and 5.0.x versions may be a

[SECURITY] CVE-2009-2693 Apache Tomcat unexpected file deletion and/or alteration

team by Marc Schoenefeld of the Red Hat Security Response Team References: [1] http://tomcat.apache.org/security.html Mark Thomas -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.9 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJLXMF6AAoJEBDAHFov

[ANN] Apache Tomcat 7.0.0 beta released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.0 beta. Note that this version has 4 zip binaries: a generic one and three bundled with Tomcat native binaries for Windows operating systems running on different CPU architectures. Apache Tomcat 7.0 includes new f

[ANN] Apache Tomcat 7.0.0-beta released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.0 beta. Apache Tomcat 7.0 includes new features over Apache Tomcat 6.0, including support for the new Servlet 3.0, JSP 2.2 and EL 2.2 specifications, web application memory leak detection and prevention, improved s

[ANN] Apache Tomcat 7.0.2 beta released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.2 beta. Apache Tomcat 7.0 includes new features over Apache Tomcat 6.0, including support for the new Servlet 3.0, JSP 2.2 and EL 2.2 specifications, web application memory leak detection and prevention, improved secu

[ANN] Apache Tomcat 7.0.4 beta released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.4 beta. Apache Tomcat 7.0 includes new features over Apache Tomcat 6.0, including support for the new Servlet 3.0, JSP 2.2 and EL 2.2 specifications, web application memory leak detection and prevention, improved secu

[SECURITY] CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability Severity: Tomcat 7.0.x - Low, Tomcat 6.0.x - Moderate Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.4 - Not affected in default configuration.

[SECURITY] CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability Severity: Tomcat 7.0.x - Low, Tomcat 6.0.x - Moderate Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.4 - Not affected in default configuration.

[ANN] Apache Tomcat 7.0.5 beta released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.5 beta. Apache Tomcat 7.0.5 beta contains performance improvements in session management, a number of new features including support for parallel deployment of multiple versions of the same web application and a redes

[ANN] Apache Tomcat 7.0.6 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.6. This is the first stable release of the Tomcat 7 branch. Apache Tomcat 7.0.6 contains further performance improvements in session management, a new binary distribution targeted at users embedding Tomcat in other a

[SECURITY] CVE-2010-3718 Apache Tomcat Local bypass of security manger file permissions

CVE-2010-3718 Apache Tomcat Local bypass of security manger file permissions Severity: Low Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.3 - Tomcat 6.0.0 to 6.0.? - Tomcat 5.5.0 to 5.5.? - Earlier, unsupported versions may also be affected Description: When run

[ANN] Apache Tomcat 7.0.8 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.8 Apache Tomcat 7.0.8 is primarily a security and bug fix release with numerous fixes compared to 7.0.6. Please refer to the change log for the list of changes: http://tomcat.apache.org/tomcat-7.0-doc/changelog.html

[SECURITY] Oracle JVM bug causes denial of service in Apache Tomcat

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 The original report is [1]. Tomcat is affected when accessing a form based security constrained page or any page that calls javax.servlet.ServletRequest.getLocale() or javax.servlet.ServletRequest.getLocales(). Work-arounds have been implemented in

[SECURITY] CVE-2011-0534 Apache Tomcat DoS vulnerability

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2011-0534 Apache Tomcat DoS vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.6 - - Tomcat 6.0.0 to 6.0.30 Description: Tomcat did not enforce the maxHttpHeaderSize limit while p

[SECURITY] CVE-2011-0013 Apache Tomcat Manager XSS vulnerability

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2011-0013 Apache Tomcat Manager XSS vulnerability Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.5 - - Tomcat 6.0.0 to 6.0.29 - - Tomcat 5.5.0 to 5.5.31 - - Earlier, unsupported versions may also

[SECURITY] CVE-2010-3718 Apache Tomcat Local bypass of security manger file permissions

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2010-3718 Apache Tomcat Local bypass of security manger file permissions Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.3 - - Tomcat 6.0.0 to 6.0.? - - Tomcat 5.5.0 to 5.5.? - - Earlier, unsupport

[SECURITY] Tomcat 7 ignores @ServletSecurity annotations

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 As reported on the users list [1], both Tomcat 7.0.8 and the latest Tomcat 7 code from svn appear to ignore @ServletSecurity annotations. Assuming this issue is confirmed, it may lead to authentication bypass and information disclosure. The exact deta

[ANN] Apache Tomcat 7.0.10 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.10 Apache Tomcat 7.0.10 is primarily a security and bug fix release with numerous fixes compared to 7.0.8. Please refer to the change log for the list of changes: http://tomcat.apache.org/tomcat-7.0-doc/changelog.htm

[SECURITY] Tomcat 7 ignores @ServletSecurity annotations

The fix in Tomcat 7.0.10 was incomplete. @SecurityAnnotations are still ignored when there are no security constraints defined in web.xml (a typical use case). There will be a Tomcat 7.0.11 release shortly to address this. In the meantime, the workaround of specifying at least one security constra

[ANN] Apache Tomcat 7.0.11 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.11 Apache Tomcat 7.0.11 is primarily a security fix release with a small number of additional bug fixes compared to 7.0.10. Please refer to the change log for the list of changes: http://tomcat.apache.org/tomcat-7.0-

[SECURITY] CVE-2011-1088 Apache Tomcat security constraint bypass

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2011-1088 Apache Tomcat security constraint bypass Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.10 - - Earlier versions are not affected Description: When a web application was started, @

[ANN] Apache Tomcat 7.0.12 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.12. Apache Tomcat 7.0.12 includes bug fixes and the following new features compared to version 7.0.11: * initial support for SPNEGO/Kerberos authentication (also referred to as Windows authentication); * provide a ne

[SECURITY] CVE-2011-1183 Apache Tomcat security constraint bypass

CVE-2011-1183 Apache Tomcat security constraint bypass Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.11 - Earlier versions are not affected Description: A regression in the fix for CVE-2011-1088 meant that security constraints were ignored when no lo

[SECURITY] CVE-2011-1475 Apache Tomcat information disclosure

CVE-2011-1475 Apache Tomcat information disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.11 - Earlier versions are not affected Description: Changes introduced to the HTTP BIO connector to support Servlet 3.0 asynchronous requests di

[SECURITY] CVE-2011-1582 Apache Tomcat security constraint bypass

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2011-1582 Apache Tomcat security constraint bypass Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.12-7.0.13 - - Earlier versions are not affected Description: An error in the fixes for CVE-2011-1088

[ANN] Apache Tomcat 7.0.16 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.16. Apache Tomcat 7.0.16 includes bug fixes and the following new features compared to version 7.0.14: - NIO implementation of the AJP connector - Enable Servlet 3 asynchronous processing support when using clustering

[SECURITY] CVE-2011-2204 - Apache Tomcat information disclosure

CVE-2011-2204 Apache Tomcat information disclosure Severity: Low Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.16 - Tomcat 6.0.0 to 6.0.32 - Tomcat 5.5.0 to 5.5.33 Earlier, unsupported versions may also be affected Description: When using the MemoryUserDatabase

[SECURITY] CVE-2011-2526 Apache Tomcat Information disclosure and availability vulnerabilities

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2011-2526: Apache Tomcat Information disclosure and availability vulnerabilities Severity: low Vendor: The Apache Software Foundation Versions Affected: Tomcat 7.0.0 to 7.0.18 Tomcat 6.0.0 to 6.0.32 Tomcat 5.5.0 to 5.0.33 Previous

[ANN] Apache Tomcat 7.0.19 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.19 Apache Tomcat 7.0.19 includes security fixes, bug fixes and the following new features compared to version 7.0.16: - JSP recompilation is now triggered by any change (backwards as well as forwards) in the last mo

[ANN] End of life for Apache Tomcat 5.5.x

The Apache Tomcat team announces that support for Apache Tomcat 5.5.x will end on 30 September 2012. This means that after 30 September 2012: - releases from the 5.5.x branch are highly unlikely - bugs affecting only the 5.5.x branch will not be addressed - security vulnerability reports will not

[ANN] Apache Tomcat 7.0.20 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.20 Apache Tomcat 7.0.20 includes bug fixes and the following new features and fixes compared to version 7.0.19: - JSP files with dependencies in JARs are no longer recompiled on every access thereby improving performa

[SECURITY] CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat)

CVE-2011-2729: Commons Daemon fails to drop capabilities (Apache Tomcat) Severity: Important Vendor: The Apache Software Foundation Versions Affected: Tomcat 7.0.0 to 7.0.19 Tomcat 6.0.30 to 6.0.32 Tomcat 5.5.32 to 5.5.33 Description: Due to a bug in the capabilities code, jsvc (the service wra

[SECURITY] CVE-2011-2481: Apache Tomcat information disclosure vulnerability

CVE-2011-2481: Apache Tomcat information disclosure vulnerability Severity: low Vendor: The Apache Software Foundation Versions Affected: Tomcat 7.0.0 to 7.0.16 Previous versions are not affected. Description: The re-factoring of XML validation for Tomcat 7.0.x re-introduced the vulnerability p

[SECURITY] CVE-2011-3190 Apache Tomcat Authentication bypass and information disclosure

CVE-2011-3190 Apache Tomcat Authentication bypass and information disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.20 - Tomcat 6.0.0 to 6.0.33 - Tomcat 5.5.0 to 5.5.33 - Earlier, unsupported versions may also be affected Description:

[ANN] Apache Tomcat 7.0.21 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.21 Apache Tomcat 7.0.21 includes security fixes, bug fixes and new features compared to version 7.0.20 including: - A fix for CVE-2011-3190 that allowed an attacker to inject requests when Tomcat was configured behind

[SECURITY] CVE-2011-1184 Apache Tomcat - Multiple weaknesses in HTTP DIGEST authentication

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2011-1184 Apache Tomcat - Multiple weaknesses in HTTP DIGEST authentication Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.11 - - Tomcat 6.0.0 to 6.0.32 - - Tomcat 5.5.0 to 5.5.33 - - Earlier

[ANN] Apache Tomcat 7.0.22 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.22 Apache Tomcat 7.0.22 includes bug fixes and new features compared to version 7.0.21 including: - Further improvements to the memory leak detection and prevention features. - Fix issue that prevented using SSL with

[SECURITY] CVE-2011-3376 Apache Tomcat - Privilege Escalation via Manager app

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2011-3376 Apache Tomcat - Privilege Escalation via Manager app Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.21 Description: This issue only affects environments running web applications that ar

[ANN] Apache Tomcat 7.0.23 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.23 This release includes numerous bug fixes and several new features compared to version 7.0.22. The notable new features include: * The ability to start and stop child containers (primarily Contexts: i.e. web appli

[SECURITY] Apache Tomcat and the hashtable collision DoS vulnerability

You may have read about a recently announced vulnerability rooted in the Java hashtable implementation [1]. Since Apache Tomcat uses a hashtable for storing HTTP request parameters, it is affected by this issue. As per [1], it appears that Oracle will not be providing a fix for this vulnerability

[SECURITY] CVE-2011-3375 Apache Tomcat Information disclosure

CVE-2011-3375 Apache Tomcat Information disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.21 - Tomcat 6.0.30 to 6.0.33 - Earlier versions are not affected Description: For performance reasons, information parsed from a request is ofte

[SECURITY] CVE-2012-0022 Apache Tomcat Denial of Service

CVE-2012-0022 Apache Tomcat Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.22 - Tomcat 6.0.0 to 6.0.33 - Tomcat 5.5.0 to 5.5.34 - Earlier, unsupported versions may also be affected Description: Analysis of the recent hash co

[ANN] Apache Tomcat 7.0.25 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.25 This release includes numerous bug fixes and several new features compared to version 7.0.23. The notable new features include: * Align the Servlet 3.0 implementation with the changes defined in the first mainten

[ANN] Apache Tomcat 7.0.26 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.26 This release is primarily a bug fix release and includes numerous bug fixes compared to version 7.0.25. The notable bug fixes include: * Improved @HandlesTypes processing which no longer loads all classes on web

[ANN] Apache Tomcat 7.0.27 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.27 This release is includes significant new features as well as a number of bug fixes compared to version 7.0.26. The notable changes include: * Support for the WebSocket protocol (RFC6455). Both streaming and messa

[ANN] Apache Tomcat 7.0.28 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.28. Apache Tomcat is an open source software implementation of the Java Servlet and JavaServer Pages technologies. This release is includes may improvements as well as a number of bug fixes compared to version 7.0.27

[ANN] Apache Tomcat 7.0.29 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.29. Apache Tomcat is an open source software implementation of the Java Servlet and JavaServer Pages technologies. This release corrects a small number of regressions introduced in the 7.0.28 release and takes accoun

[ANN] Apache Tomcat 7.0.30 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.30. Apache Tomcat is an open source software implementation of the Java Servlet and JavaServer Pages technologies. This release contains numerous bug fixes and improvements compared to version 7.0.29. The notable cha

[ANN] Apache Tomcat 7.0.32 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.32. Apache Tomcat is an open source software implementation of the Java Servlet and JavaServer Pages technologies. This release contains a small number of bug fixes and improvements compared to version 7.0.30. The no

[ANN] Apache Tomcat 5.5.36 released

The Apache Tomcat Team announces the immediate availability of Apache Tomcat 5.5.36. Apache Tomcat 5.5.36 is primarily a bug-fix release. As per the previous end of life announcement [1] this will almost certainly be the final Apache Tomcat 5.5.x release. Users of the 5.5.x series are strongly en

[SECURITY] CVE-2012-3439 Apache Tomcat DIGEST authentication weaknesses

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2012-3439 Apache Tomcat DIGEST authentication weaknesses Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.29 - - Tomcat 6.0.0 to 6.0.35 - - Tomcat 5.5.0 to 5.5.35 - - Earlier, unsupported versi

[SECURITY] CVE-2012-2733 Apache Tomcat Denial of Service

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2012-2733 Apache Tomcat Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.27 - - Tomcat 6.0.0 to 6.0.35 Description: The checks that limited the permitted size of request hea

Fwd: [ANN] Apache Tomcat 6.0.36 released

It has been brought to the attention of the Apache Tomcat PMC that the Tomcat 6.0.36 release announcement below was sent to the Tomcat users list and the Tomcat developers list but not the Tomcat and ASF announce lists. Please accept our apologies if you missed the Apache Tomcat 6.0.36 release ann

[ANN] Apache Tomcat 7.0.33 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.33. Apache Tomcat is an open source software implementation of the Java Servlet and JavaServer Pages technologies. This release contains a small number of bug fixes and improvements compared to version 7.0.32. The no

CVE-2012-4534 Apache Tomcat denial of service

CVE-2012-4534 Apache Tomcat denial of service Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.27 - Tomcat 6.0.0 to 6.0.35 Description: When using the NIO connector with sendfile and HTTPS enabled, if a client breaks the connection while readin

CVE-2012-3546 Apache Tomcat Bypass of security constraints

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2012-3546 Apache Tomcat Bypass of security constraints Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.29 - - Tomcat 6.0.0 to 6.0.35 Earlier unsupported versions may also be affected Descrip

CVE-2012-4431 Apache Tomcat Bypass of CSRF prevention filter

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2012-4431 Apache Tomcat Bypass of CSRF prevention filter Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.31 - - Tomcat 6.0.0 to 6.0.35 Description: The CSRF prevention filter could be bypass

[ANN] Apache Tomcat 7.0.34 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.34. Apache Tomcat is an open source software implementation of the Java Servlet and JavaServer Pages technologies. This release contains a small number of bug fixes and improvements compared to version 7.0.33. The not

Re: [ANN] End of life for Apache Tomcat 5.5.x

On 10/08/2011 13:00, Mark Thomas wrote: > The Apache Tomcat team announces that support for Apache Tomcat 5.5.x > will end on 30 September 2012. > > This means that after 30 September 2012: > - releases from the 5.5.x branch are highly unlikely > - bugs affecting only the 5.5.x

[ANN] Apache Tomcat 7.0.35 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.35. Apache Tomcat is an open source software implementation of the Java Servlet and JavaServer Pages technologies. This release contains a small number of bug fixes and improvements compared to version 7.0.34. The not

[ANN] Apache Tomcat 7.0.37 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.37. Apache Tomcat is an open source software implementation of the Java Servlet and JavaServer Pages technologies. This release contains a small number of bug fixes and improvements compared to version 7.0.35. The not

[ANN] Apache Tomcat 7.0.39 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.39. Apache Tomcat is an open source software implementation of the Java Servlet and JavaServer Pages technologies. This release contains a number of bug fixes and improvements compared to version 7.0.37. The notable c

CVE-2013-2071 Request mix-up if AsyncListener method throws RuntimeException

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2013-2071 Request mix-up if AsyncListener method throws RuntimeException Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.39 Description: Bug 54178 described a scenario where ele

[ANN] Apache Tomcat 7.0.40 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.40. Apache Tomcat is an open source software implementation of the Java Servlet, JavaServer Pages and Java Expression Language technologies. This release contains a security fix and a number of bug fixes and improvem

[SECURITY] CVE-2013-2067 Session fixation with FORM authenticator

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2013-2067 Session fixation with FORM authenticator Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.32 - - Tomcat 6.0.21 to 6.0.36 Description: FORM authentication associates the most recent

[SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2012-3544 Chunked transfer encoding extension size is not limited Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.29 - - Tomcat 6.0.0 to 6.0.36 Description: When processing a request submitt

[ANN] Apache Tomcat 7.0.41 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.41. Apache Tomcat is an open source software implementation of the Java Servlet, JavaServer Pages and Java Expression Language technologies. This release contains a number of bug fixes and improvements compared to

[ANN] Apache Tomcat 7.0.42 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.42. Apache Tomcat is an open source software implementation of the Java Servlet, JavaServer Pages and Java Expression Language technologies. This release contains a number of bug fixes and improvements compared to ve

[ANN] Apache Tomcat 8.0.0-RC1 (alpha) available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.0.0-RC1 (alpha). Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language and Java WebSocket technologies. Apache Tomcat 8 is aligned with Java E

[ANN] Apache Tomcat 8.0.0-RC3 (alpha) available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.0.0-RC3 (alpha). Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language and Java WebSocket technologies. Apache Tomcat 8 is aligned with Java E

[ANN] Apache Tomcat 8.0.0-RC5 (alpha) available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.0.0-RC5 (alpha). Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language and Java WebSocket technologies. Apache Tomcat 8 is aligned with Java E

[ANNOUNCE] Apache Commons Pool 2.0 released

website: http://commons.apache.org/proper/commons-pool/ Mark Thomas, on behalf of the Apache Commons community

<    1   2   3   4   5   >