[ANN] Apache Tomcat 8.5.37 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.37. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and Java Authentication Service Provider Interface for Containers

[ANN] Apache Tomcat 9.0.14 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.14. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.14 is a bugfix and

[ANN] Apache Tomcat Native 1.2.19 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat Native 1.2.19 stable. The key features of this release are: - Fixed memory leaks when using OCSP checks - Windows binaries built with APR 1.6.5 and OpenSSL 1.1.1.a - Windows binaries built with APR 1.6.5 and OpenSSL

[ANN] Apache Tomcat 8.5.35 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.35. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and Java Authentication Service Provider Interface for Containers

[SECURITY] CVE-2018-11759 Apache Tomcat JK (mod_jk) Connector path traversal

CVE-2018-11759 Apache Tomcat JK (mod_jk) Connector path traversal Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat JK mod_jk Connector 1.2.0 to 1.2.44 Description: The Apache Web Server (httpd) specific code that normalised the requested path

[ANN] Apache Tomcat JK Connectors 1.2.46 released

The Apache Tomcat Project is proud to announce the release of version 1.2.46 of the Apache Tomcat Connectors. This version fixes a number of bugs found in previous releases. Full details of these changes and new features, are available in the Apache Tomcat Connectors changelog:

[SECURITY] CVE-2018-11784 Apache Tomcat - Open Redirect

CVE-2018-11784 Apache Tomcat - Open Redirect Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.11 Apache Tomcat 8.5.0 to 8.5.33 Apache Tomcat 7.0.23 to 7.0.90 The unsupported 8.0.x release line has not been analysed but is likely to be

[ANN] Apache Tomcat 8.5.34 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.34. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and Java Authentication Service Provider Interface for Containers

[ANN] Apache Tomcat 9.0.12 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.12. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.12 is a bugfix and

[ANN] Apache Tomcat Connectors 1.2.44 released

The Apache Tomcat Project is proud to announce the release of version 1.2.44 of the Apache Tomcat Connectors. This version fixes a number of bugs found in previous releases. Full details of these changes and new features, are available in the Apache Tomcat Connectors changelog:

[ANN] Apache Tomcat 9.0.11 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.11. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.11 is a bugfix and

[ANN] Apache Tomcat 8.5.31 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.31. Tomcat 8.x users should be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language,

[ANN] Apache Tomcat 9.0.8 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.8. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.8 is a bugfix and

[ANN] TomcatCon Schedules Announced

All, I am delighted to announce the schedules are now available for: TomcatCon Berlin 13-14 June, 2018: http://apachecon.com/euroadshow18/tomcat-schedule.html TomcatCon Montréal 24-25 September, 2018: http://apachecon.dukecon.org/acna/2018/#/schedule/2018-09-24 Full details, including

[ANN] Apache Tomcat 8.5.30 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.30. Tomcat 8.x users should be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language,

[ANN] Apache Tomcat 8.5.29 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.29. Tomcat 8.x users should be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language,

[SECURITY] CVE-2018-1304 Security constraints mapped to context root are ignored

CVE-2018-1304 Security constraints mapped to context root are ignored Severity: High Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.4 Apache Tomcat 8.5.0 to 8.5.27 Apache Tomcat 8.0.0.RC1 to 8.0.49 Apache Tomcat 7.0.0 to 7.0.84 Description: The URL

[SECURITY] CVE-2018-1305 Security constraint annotations applied too late

CVE-2018-1305 Security constraint annotations applied too late Severity: High Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.4 Apache Tomcat 8.5.0 to 8.5.27 Apache Tomcat 8.0.0.RC1 to 8.0.49 Apache Tomcat 7.0.0 to 7.0.84 Description: Security

[SECURITY] CVE-2017-15706 Apache Tomcat Incorrectly documented CGI search algorithm

CVE-2017-15706 Apache Tomcat Incorrectly documented CGI search algorithm Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M22 to 9.0.1 Apache Tomcat 8.5.16 to 8.5.23 Apache Tomcat 8.0.45 to 8.0.47 Apache Tomcat 7.0.79 to 7.0.82 Description: As part of

[SECURITY] CVE-2017-15698 Apache Tomcat Native Connector - OCSP check omitted

CVE-2017-15698 Apache Tomcat Native Connector - OCSP check omitted Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat Native 1.2.0 to 1.2.14 Apache Tomcat Native 1.1.23 to 1.1.34 Description: When parsing the AIA-Extension field of a client certificate,

[ANN] Apache Tomcat 9.0.4 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.4. This is the first stable release of the 9.0.x series. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC

[ANN] Apache Tomcat 8.5.24 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.24. Tomcat 8.x users should normally be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression

[ANN] Apache Tomcat Native 1.2.16 released

Apologies for the delayed announcement. The Apache Tomcat team announces the immediate availability of Apache Tomcat Native 1.2.16 stable. The key features of this release are: - Windows binaries built with APR 1.6.3 and OpenSSL 1.0.2m. - Improved parsing of OCSP extensions Note that users

[SECURITY] CVE-2017-12617 Apache Tomcat Remote Code Execution via JSP upload

CVE-2017-12617 Apache Tomcat Remote Code Execution via JSP Upload Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0 Apache Tomcat 8.5.0 to 8.5.22 Apache Tomcat 8.0.0.RC1 to 8.0.46 Apache Tomcat 7.0.0 to 7.0.81 Description: When

[ANN] Apache Tomcat 9.0.1 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.1 (beta). Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.1 is the first

[ANN] Apache Tomcat 8.5.23 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.23. Tomcat 8.x users should normally be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression

[ANN] End of life for Apache Tomcat Native 1.1.x

The Apache Tomcat Team announces that support for Apache Tomcat Native 1.1.x will end on 30 September 2018. This means that after 30 September 2018: - releases from the 1.1.x branch are highly unlikely - bugs affecting only the 1.1.x branch will not be addressed - security vulnerability reports

[SECURITY] Apache Tomcat Possible additional RCE via JSP upload

All, Following the announcement of CVE-2017-12615 [1], the Apache Tomcat Security Team has received multiple reports that a similar vulnerability exists in all current Tomcat versions and affects all operating systems. Unfortunately, one of these reports was made via the public bug tracker [2]

[CORRECTION][SECURITY] CVE-2017-12615 Apache Tomcat Remote Code Execution via JSP upload

The body of the original advisory referred to CVE-2017-7674. This was incorrect. It was a copy and paste error from a previous Tomcat advisory. The correct CVE reference is CVE-2017-12615, as per the subject line. On 19/09/17 11:58, Mark Thomas wrote: > CVE-2017-12615 Apache Tomcat Remote C

[SECURITY] CVE-2017-12615 Apache Tomcat Remote Code Execution via JSP upload

CVE-2017-7674 Apache Tomcat Remote Code Execution via JSP Upload Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 7.0.0 to 7.0.79 Description: When running on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of

[SECURITY] CVE-2017-12616 Apache Tomcat Information Disclosure

CVE-2017-7674 Apache Tomcat Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 7.0.0 to 7.0.80 Description: When using a VirtualDirContext it was possible to bypass security constraints and/or view the source code of JSPs for

[UPDATE][SECURITY] CVE-2017-7675 Apache Tomcat Security Constraint Bypass

CVE-2017-7675 Apache Tomcat Security Constraint Bypass Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M21 Apache Tomcat 8.5.0 to 8.5.15 Description: The HTTP/2 implementation bypassed a number of security checks that prevented

[SECURITY] CVE-2017-7675 Apache Tomcat Security Constraint Bypass

CVE-2017-7675 Apache Tomcat Cache Poisoning Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M21 Apache Tomcat 8.5.0 to 8.5.15 Description: The HTTP/2 implementation bypassed a number of security checks that prevented directory

[SECURITY] CVE-2017-7674 Apache Tomcat Cache Poisoning

CVE-2017-7674 Apache Tomcat Cache Poisoning Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M21 Apache Tomcat 8.5.0 to 8.5.15 Apache Tomcat 8.0.0.RC1 to 8.0.44 Apache Tomcat 7.0.41 to 7.0.78 Description: The CORS Filter did not an

[ANN] Apache Tomcat 9.0.0.M26 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.0.M26. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.0.M26 is a

[ANN] Apache Tomcat 8.5.16 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.16. Tomcat 8.x users should normally be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression

[ANN] Apache Tomcat 9.0.0.M22 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.0.M22. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.0.M22 is a

[SECURITY] CVE-2017-5664 Apache Tomcat Security Constraint Bypass

Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M20 Apache Tomcat 8.5.0 to 8.5.14 Apache Tomcat 8.0.0.RC1 to 8.0.43 Apache Tomcat 7.0.0 to 7.0.77 Earlier, unsupported versions have not been analysed but are likely to be affected

[ANN] Apache Tomcat 9.0.0.M20 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.0.M20. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.0.M20 is a

[SECURITY] CVE-2017-5651 Apache Tomcat Information Disclosure

CVE-2017-5651 Apache Tomcat Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M18 Apache Tomcat 8.5.0 to 8.5.12 Apache Tomcat 8.0.x and earlier are not affected Description: The refactoring of the HTTP

[SECURITY] CVE-2017-5647 Apache Tomcat Information Disclosure

CVE-2017-5647 Apache Tomcat Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M18 Apache Tomcat 8.5.0 to 8.5.12 Apache Tomcat 8.0.0.RC1 to 8.0.42 Apache Tomcat 7.0.0 to 7.0.76 Apache Tomcat 6.0.0 to 6.0.52

[ANN] Apache Tomcat 9.0.0.M19 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.0.M19. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.0.M19 is a

[ANN] Apache Tomcat 7.0.76 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.76. Apache Tomcat is an open source software implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies. This release contains a number of bug fixes and

[ANN] Apache Tomcat 6.0.51 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 6.0.51. Apache Tomcat is an open source software implementation of the Java Servlet, JavaServer Pages and Java Expression Language technologies. This release contains a number of bug fixes and improvements compared to

[ANN] Apache Tomcat 8.0.42 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.0.42. Please note that Tomcat 8.x users should normally be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8.0 is an open source software implementation of the Java Servlet, JavaServer Pages, Java

[ANN] Apache Tomcat 8.5.12 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.12. Tomcat 8.x users should normally be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression

[ANN] Apache Tomcat 9.0.0.M18 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.0.M18. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.0.M18 is a

[SECURITY] CVE-2016-8747 Apache Tomcat Information Disclosure

CVE-2016-8747 Apache Tomcat Information Disclosure Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M11 to 9.0.0.M15 Apache Tomcat 8.5.7 to 8.5.9 Description The refactoring to make wider use of ByteBuffer introduced a regression that could cause

[ANN] TomcatCon schedule announced

All, I am delighted to announce that the schedule for TomcatCon has been published: https://apachecon2017.sched.com/overview/type/TomcatCon Registration is open at: http://events.linuxfoundation.org/events/apachecon-north-america/attend/register- with early bird pricing ($600) through Sunday

[ANN] Apache Tomcat 8.5.11 available

Apologies for the delay in sending out this announcement. The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.11. Tomcat 8.x users should normally be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8 is an open source software implementation of

[SECURITY] CVE-2016-8745 Apache Tomcat Information Disclosure

CVE-2016-8745 Apache Tomcat Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M13 Apache Tomcat 8.5.0 to 8.5.8 Earlier versions are not affected. Description The refactoring of the Connector code for 8.5.x

[SECURITY] CVE-2016-8735 Apache Tomcat Remote Code Execution

CVE-2016-8735 Apache Tomcat Remote Code Execution Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M11 Apache Tomcat 8.5.0 to 8.5.6 Apache Tomcat 8.0.0.RC1 to 8.0.38 Apache Tomcat 7.0.0 to 7.0.72 Apache Tomcat 6.0.0 to 6.0.47 Earlier,

[SECURITY] CVE-2016-6817 Apache Tomcat Denial of Service

CVE-2016-6817 Apache Tomcat Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M11 Apache Tomcat 8.5.0 to 8.5.6 Earlier versions are not affected. Description The HTTP/2 header parser entered an infinite loop if

[SECURITY] CVE-2016-0762 Apache Tomcat Realm Timing Attack

CVE-2016-0762 Apache Tomcat Realm Timing Attack Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.M9 Apache Tomcat 8.5.0 to 8.5.4 Apache Tomcat 8.0.0.RC1 to 8.0.36 Apache Tomcat 7.0.0 to 7.0.70 Apache Tomcat 6.0.0 to 6.0.45 Earlier,

[ANN] Apache Tomcat 8.0.38 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.0.38. Please note that Tomcat 8.x users should normally be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8.0 is an open source software implementation of the Java Servlet, JavaServer Pages, Java

[ANN] Apache Tomcat 8.5.6 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.6. Tomcat 8.x users should normally be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression

[ANN] Apache Tomcat Native 1.2.10 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat Native 1.2.10 stable. The key features of this release are: - Windows binaries built with APR 1.5.2 and OpenSSL 1.0.2j. Note that users should now be using 1.2.x in preference to 1.1.x. Please refer to the change log

[SECURITY] CVE-2016-6808 Apache Tomcat JK ISAPI Connector buffer overflow

CVE-2016-6808 Apache Tomcat JK ISAPI Connector buffer overflow Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.41 Description The IIS/ISAPI specific code implements special handling when a virtual host is present. The

[ANN] Apache Tomcat Connectors 1.2.42 released

The Apache Tomcat Project is proud to announce the release of version 1.2.42 of the Apache Tomcat Connectors. This version fixes a number of bugs found in previous releases. Full details of these changes and new features, are available in the Apache Tomcat Connectors changelog:

[ANN] Apache Tomcat 8.5.5 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.5. Tomcat 8.x users should normally be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression

[ANN] Apache Tomcat 8.0.37 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.0.37. Please note that Tomcat 8.x users should normally be using 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8.0 is an open source software implementation of the Java Servlet, JavaServer Pages, Java

[ANN] Apache Tomcat 9.0.0.M10 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.0.M10. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.0.M10 is a

[ANN] Apache Tomcat 8.5.4 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.5.4. This is the first stable release of the 8.5.x branch. Tomcat 8.x users should now use 8.5.x releases in preference to 8.0.x releases. Apache Tomcat 8 is an open source software implementation of the Java Servlet,

[ANN] Apache Tomcat 9.0.0.M9 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.0.M9. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.0.M9 is a milestone

[ANN] Apache Tomcat Native 1.2.8 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat Native 1.2.8 stable. The key features of this release are: - Improved performance with concurrent loads - Correctly enable and disable OCSP in the binaries for Windows - Fix a bug in the handling of EAGAIN during

[SECURITY][CORRECTION] CVE-2016-3092 Apache Tomcat Denial of Service

Note: This announcement corrects several errors and omissions in the Tomcat aspects of the announcement for CVE-2016-3092 from the Apache Commons project that was recently forwarded to various Apache Tomcat mailing lists. For the sake of clarity, the Tomcat specific corrections are as follows: 1.

[ANN] Apache Tomcat Native 1.2.3 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat Native 1.2.3 stable. The key features of this release are: - Java keystore support. - Various fixes to align the Java and native APIs - Various fixes if building without OpenSSL - Windows binaries built with OpenSSL

[ANN] Apache Tomcat 8.0.23 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.0.23. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language and Java WebSocket technologies. Apache Tomcat 8.0.23 includes numerous fixes for

[ANN] Apache Tomcat 8.0.21 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.0.21. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language and Java WebSocket technologies. Apache Tomcat 8.0.21 includes numerous fixes for

[ANN] Apache Tomcat 8.0.20 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.0.20. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language and Java WebSocket technologies. Apache Tomcat 8.0.20 includes numerous fixes for

[ANN] Apache Tomcat 8.0.15 available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.0.15. Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language and Java WebSocket technologies. Apache Tomcat 8.0.15 includes numerous fixes for

[SECURITY] CVE-2013-4444 Remote Code Execution in Apache Tomcat

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2013- Remote Code Execution Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 7.0.0 to 7.0.39 Description: In very limited circumstances, it was possible for an attacker to upload a malicious

[SECURITY] CVE-2013-4590 Information disclosure via XXE when running untrusted web applications

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2013-4590 Information disclosure via XXE when running untrusted web applications Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Apache Tomcat 8.0.0-RC1 to 8.0.0-RC5 - - Apache Tomcat 7.0.0 to 7.0.47 - - Apache

[ANN] Apache Tomcat 8.0.0-RC1 (alpha) available

The Apache Tomcat team announces the immediate availability of Apache Tomcat 8.0.0-RC1 (alpha). Apache Tomcat 8 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language and Java WebSocket technologies. Apache Tomcat 8 is aligned with Java

[ANN] Apache Tomcat 7.0.42 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.42. Apache Tomcat is an open source software implementation of the Java Servlet, JavaServer Pages and Java Expression Language technologies. This release contains a number of bug fixes and improvements compared to

[SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2012-3544 Chunked transfer encoding extension size is not limited Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.29 - - Tomcat 6.0.0 to 6.0.36 Description: When processing a request

CVE-2013-2071 Request mix-up if AsyncListener method throws RuntimeException

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2013-2071 Request mix-up if AsyncListener method throws RuntimeException Severity: Moderate Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.39 Description: Bug 54178 described a scenario where

CVE-2012-4431 Apache Tomcat Bypass of CSRF prevention filter

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2012-4431 Apache Tomcat Bypass of CSRF prevention filter Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.31 - - Tomcat 6.0.0 to 6.0.35 Description: The CSRF prevention filter could be

[ANN] Apache Tomcat 5.5.36 released

The Apache Tomcat Team announces the immediate availability of Apache Tomcat 5.5.36. Apache Tomcat 5.5.36 is primarily a bug-fix release. As per the previous end of life announcement [1] this will almost certainly be the final Apache Tomcat 5.5.x release. Users of the 5.5.x series are strongly

[SECURITY] CVE-2011-3375 Apache Tomcat Information disclosure

CVE-2011-3375 Apache Tomcat Information disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.21 - Tomcat 6.0.30 to 6.0.33 - Earlier versions are not affected Description: For performance reasons, information parsed from a request is

[SECURITY] CVE-2012-0022 Apache Tomcat Denial of Service

CVE-2012-0022 Apache Tomcat Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.22 - Tomcat 6.0.0 to 6.0.33 - Tomcat 5.5.0 to 5.5.34 - Earlier, unsupported versions may also be affected Description: Analysis of the recent hash

[SECURITY] CVE-2011-3190 Apache Tomcat Authentication bypass and information disclosure

CVE-2011-3190 Apache Tomcat Authentication bypass and information disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.20 - Tomcat 6.0.0 to 6.0.33 - Tomcat 5.5.0 to 5.5.33 - Earlier, unsupported versions may also be affected

[ANN] Apache Tomcat 7.0.19 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.19 Apache Tomcat 7.0.19 includes security fixes, bug fixes and the following new features compared to version 7.0.16: - JSP recompilation is now triggered by any change (backwards as well as forwards) in the last

[SECURITY] CVE-2011-2526 Apache Tomcat Information disclosure and availability vulnerabilities

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2011-2526: Apache Tomcat Information disclosure and availability vulnerabilities Severity: low Vendor: The Apache Software Foundation Versions Affected: Tomcat 7.0.0 to 7.0.18 Tomcat 6.0.0 to 6.0.32 Tomcat 5.5.0 to 5.0.33

[SECURITY] CVE-2011-2204 - Apache Tomcat information disclosure

CVE-2011-2204 Apache Tomcat information disclosure Severity: Low Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.16 - Tomcat 6.0.0 to 6.0.32 - Tomcat 5.5.0 to 5.5.33 Earlier, unsupported versions may also be affected Description: When using the MemoryUserDatabase

[ANN] Apache Tomcat 7.0.12 released

The Apache Tomcat team announces the immediate availability of Apache Tomcat 7.0.12. Apache Tomcat 7.0.12 includes bug fixes and the following new features compared to version 7.0.11: * initial support for SPNEGO/Kerberos authentication (also referred to as Windows authentication); * provide a

[SECURITY] CVE-2011-1475 Apache Tomcat information disclosure

CVE-2011-1475 Apache Tomcat information disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Tomcat 7.0.0 to 7.0.11 - Earlier versions are not affected Description: Changes introduced to the HTTP BIO connector to support Servlet 3.0 asynchronous requests

[SECURITY] CVE-2011-1088 Apache Tomcat security constraint bypass

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2011-1088 Apache Tomcat security constraint bypass Severity: Important Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.10 - - Earlier versions are not affected Description: When a web application was started,

[SECURITY] Oracle JVM bug causes denial of service in Apache Tomcat

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 The original report is [1]. Tomcat is affected when accessing a form based security constrained page or any page that calls javax.servlet.ServletRequest.getLocale() or javax.servlet.ServletRequest.getLocales(). Work-arounds have been implemented in

[SECURITY] CVE-2011-0013 Apache Tomcat Manager XSS vulnerability

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 CVE-2011-0013 Apache Tomcat Manager XSS vulnerability Severity: Low Vendor: The Apache Software Foundation Versions Affected: - - Tomcat 7.0.0 to 7.0.5 - - Tomcat 6.0.0 to 6.0.29 - - Tomcat 5.5.0 to 5.5.31 - - Earlier, unsupported versions may also

<    1   2   3