[Bug 56561] NoSuchElementException on empty attribute in Validator$ValidateVisitor.getJspAttribute(Validator.java:1385)

2014-05-27 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56561 --- Comment #3 from Mark Thomas ma...@apache.org --- We don't revoke releases, we just produce a new release. How quickly the next set of releases happens depends on a number of factors. I was planning another 8.0.x shortly anyway to try

[Bug 56568] New: Incompatible change in JSPs only permit GET POST or HEAD

2014-05-27 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56568 Bug ID: 56568 Summary: Incompatible change in JSPs only permit GET POST or HEAD Product: Tomcat 8 Version: 8.0.1 Hardware: PC Status: NEW

[Bug 56568] Incompatible change in JSPs only permit GET POST or HEAD

2014-05-27 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56568 Grigory gkis...@yandex.ru changed: What|Removed |Added Hardware|PC |All

svn commit: r1597753 - /tomcat/trunk/test/webapp/bug5nnnn/bug56334and56561.jspx

2014-05-27 Thread kkolinko
Author: kkolinko Date: Tue May 27 11:59:14 2014 New Revision: 1597753 URL: http://svn.apache.org/r1597753 Log: Add license header Modified: tomcat/trunk/test/webapp/bug5/bug56334and56561.jspx Modified: tomcat/trunk/test/webapp/bug5/bug56334and56561.jspx URL:

svn commit: r1597754 - /tomcat/trunk/test/webapp/bug5nnnn/bug53545.html

2014-05-27 Thread kkolinko
Author: kkolinko Date: Tue May 27 12:01:52 2014 New Revision: 1597754 URL: http://svn.apache.org/r1597754 Log: Add license header Modified: tomcat/trunk/test/webapp/bug5/bug53545.html Modified: tomcat/trunk/test/webapp/bug5/bug53545.html URL:

svn commit: r1597755 - /tomcat/trunk/test/webapp/WEB-INF/bug53545.tld

2014-05-27 Thread kkolinko
Author: kkolinko Date: Tue May 27 12:04:30 2014 New Revision: 1597755 URL: http://svn.apache.org/r1597755 Log: Add license header Modified: tomcat/trunk/test/webapp/WEB-INF/bug53545.tld Modified: tomcat/trunk/test/webapp/WEB-INF/bug53545.tld URL:

svn commit: r1597757 - in /tomcat/tc7.0.x/trunk: ./ test/webapp-3.0/WEB-INF/bug53545.tld test/webapp-3.0/bug5nnnn/bug53545.html test/webapp-3.0/bug5nnnn/bug56334and56561.jspx

2014-05-27 Thread kkolinko
Author: kkolinko Date: Tue May 27 12:17:29 2014 New Revision: 1597757 URL: http://svn.apache.org/r1597757 Log: Add license header It is backport of revisions 1597753-1597755 from tomcat/trunk. Modified: tomcat/tc7.0.x/trunk/ (props changed)

svn commit: r1597759 - /tomcat/trunk/test/org/apache/coyote/http11/TestAbstractHttp11Processor.java

2014-05-27 Thread kkolinko
Author: kkolinko Date: Tue May 27 12:25:57 2014 New Revision: 1597759 URL: http://svn.apache.org/r1597759 Log: Discern the first and the second requests in the test case. Modified: tomcat/trunk/test/org/apache/coyote/http11/TestAbstractHttp11Processor.java Modified:

svn commit: r1597761 - in /tomcat/tc7.0.x/trunk: ./ test/org/apache/coyote/http11/TestAbstractHttp11Processor.java

2014-05-27 Thread kkolinko
Author: kkolinko Date: Tue May 27 12:29:00 2014 New Revision: 1597761 URL: http://svn.apache.org/r1597761 Log: Discern the first and the second requests in the test case. It is merge of r1597759 from tomcat/trunk. Modified: tomcat/tc7.0.x/trunk/ (props changed)

svn commit: r1597764 - in /tomcat/site/trunk: docs/security-6.html docs/security-7.html docs/security-8.html xdocs/security-6.xml xdocs/security-7.xml xdocs/security-8.xml

2014-05-27 Thread markt
Author: markt Date: Tue May 27 12:39:01 2014 New Revision: 1597764 URL: http://svn.apache.org/r1597764 Log: CVE-2014-0075 CVE-2014-0095 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 Modified: tomcat/site/trunk/docs/security-6.html tomcat/site/trunk/docs/security-7.html

[SECURITY] CVE-2014-0075 Apache Tomcat denial of service

2014-05-27 Thread Mark Thomas
CVE-2014-0075 Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat 8.0.0-RC1 to 8.0.3 - Apache Tomcat 7.0.0 to 7.0.52 - Apache Tomcat 6.0.0 to 6.0.39 Description: It was possible to craft a malformed chunk size as part of a chucked

[SECURITY] CVE-2014-0095 Apache Tomcat denial of service

2014-05-27 Thread Mark Thomas
CVE-2014-0095 Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat 8.0.0-RC2 to 8.0.3 Description: A regression was introduced in revision 1519838 that caused AJP requests to hang if an explicit content length of zero was set on the

[SECURITY] CVE-2014-0097 Apache Tomcat information disclosure

2014-05-27 Thread Mark Thomas
CVE-2014-0097 Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat 8.0.0-RC1 to 8.0.3 - Apache Tomcat 7.0.0 to 7.0.52 - Apache Tomcat 6.0.0 to 6.0.39 Description: The code used to parse the request content length header did not

[SECURITY] CVE-2014-0119 Apache Tomcat information disclosure

2014-05-27 Thread Mark Thomas
CVE-2014-0119 Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat 8.0.0-RC1 to 8.0.5 - Apache Tomcat 7.0.0 to 7.0.53 - Apache Tomcat 6.0.0 to 6.0.39 Description: In limited circumstances it was possible for a malicious web

[SECURITY] CVE-2014-0096 Apache Tomcat information disclosure

2014-05-27 Thread Mark Thomas
CVE-2014-0096 Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat 8.0.0-RC1 to 8.0.3 - Apache Tomcat 7.0.0 to 7.0.52 - Apache Tomcat 6.0.0 to 6.0.39 Description: The default servlet allows web applications to define (at multiple

svn propchange: r1579262 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1579262 Modified property: svn:log Modified: svn:log at Tue May 27 13:01:05 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:01:05 2014 @@ -1 +1,2 @@ Improve processing of chuck size from

svn propchange: r1585853 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1585853 Modified property: svn:log Modified: svn:log at Tue May 27 13:01:43 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:01:43 2014 @@ -1,2 +1,3 @@ Redefine the globalXsltFile

svn propchange: r1580473 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1580473 Modified property: svn:log Modified: svn:log at Tue May 27 13:02:28 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:02:28 2014 @@ -1 +1,2 @@ Fix possible overflow when parsing

svn propchange: r1593821 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1593821 Modified property: svn:log Modified: svn:log at Tue May 27 13:02:59 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:02:59 2014 @@ -1,3 +1,4 @@ Defensive coding around some XML

svn propchange: r1590028 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1590028 Modified property: svn:log Modified: svn:log at Tue May 27 13:03:55 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:03:55 2014 @@ -1 +1,2 @@ Defensive coding around some XML

svn propchange: r1589997 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1589997 Modified property: svn:log Modified: svn:log at Tue May 27 13:04:22 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:04:22 2014 @@ -1 +1,2 @@ More defensive coding around some XML

svn propchange: r1578341 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1578341 Modified property: svn:log Modified: svn:log at Tue May 27 13:05:13 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:05:13 2014 @@ -1 +1,2 @@ Improve processing of chuck size from

svn propchange: r1578637 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1578637 Modified property: svn:log Modified: svn:log at Tue May 27 13:05:56 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:05:56 2014 @@ -1 +1,2 @@ Redefine globalXsltFile as relative to

svn propchange: r1578655 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1578655 Modified property: svn:log Modified: svn:log at Tue May 27 13:06:29 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:06:29 2014 @@ -1 +1,2 @@ Prevent user supplied XSLTs from

svn propchange: r1578814 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1578814 Modified property: svn:log Modified: svn:log at Tue May 27 13:07:06 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:07:06 2014 @@ -1 +1,2 @@ Fix possible overflow when parsing

Re: [SECURITY] CVE-2014-0099 Apache Tomcat information disclosure

2014-05-27 Thread Mark Thomas
CORRECTION: This is CVE-2014-0099 *NOT* -0097 Apologies for the typo On 27/05/2014 13:46, Mark Thomas wrote: CVE-2014-0099 Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat 8.0.0-RC1 to 8.0.3 - Apache

svn propchange: r1589837 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1589837 Modified property: svn:log Modified: svn:log at Tue May 27 13:10:17 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:10:17 2014 @@ -1 +1,2 @@ Add some defensive coding around some

svn propchange: r1589980 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1589980 Modified property: svn:log Modified: svn:log at Tue May 27 13:10:46 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:10:46 2014 @@ -1 +1,2 @@ More defensive coding around some XML

svn propchange: r1589990 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1589990 Modified property: svn:log Modified: svn:log at Tue May 27 13:11:10 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:11:10 2014 @@ -1 +1,2 @@ More defensive coding around some XML

svn propchange: r1578337 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1578337 Modified property: svn:log Modified: svn:log at Tue May 27 13:11:56 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:11:56 2014 @@ -1 +1,2 @@ Improve processing of chuck size from

svn propchange: r1578392 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1578392 Modified property: svn:log Modified: svn:log at Tue May 27 13:14:27 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:14:27 2014 @@ -1 +1,2 @@ Correct regression introduced in

svn propchange: r1578610 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1578610 Modified property: svn:log Modified: svn:log at Tue May 27 13:15:01 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:15:01 2014 @@ -1 +1,2 @@ Redefine globalXsltFile as relative to

svn propchange: r1578611 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1578611 Modified property: svn:log Modified: svn:log at Tue May 27 13:15:27 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:15:27 2014 @@ -1 +1,2 @@ Prevent user supplied XSLTs from

svn propchange: r1578812 - svn:log

2014-05-27 Thread markt
Author: markt Revision: 1578812 Modified property: svn:log Modified: svn:log at Tue May 27 13:15:51 2014 -- --- svn:log (original) +++ svn:log Tue May 27 13:15:51 2014 @@ -1 +1,2 @@ Fix possible overflow when parsing

svn commit: r1597774 - in /tomcat/site/trunk: docs/security-8.html xdocs/security-8.xml

2014-05-27 Thread markt
Author: markt Date: Tue May 27 13:16:39 2014 New Revision: 1597774 URL: http://svn.apache.org/r1597774 Log: Fix copy/paste error in fix revision info Modified: tomcat/site/trunk/docs/security-8.html tomcat/site/trunk/xdocs/security-8.xml Modified: tomcat/site/trunk/docs/security-8.html

buildbot success in ASF Buildbot on tomcat-7-trunk

2014-05-27 Thread buildbot
The Buildbot has detected a restored build on builder tomcat-7-trunk while building ASF Buildbot. Full details are available at: http://ci.apache.org/builders/tomcat-7-trunk/builds/85 Buildbot URL: http://ci.apache.org/ Buildslave for this Build: bb-vm_ubuntu Build Reason: scheduler Build

svn commit: r1597788 - /tomcat/tc6.0.x/trunk/STATUS.txt

2014-05-27 Thread markt
Author: markt Date: Tue May 27 13:52:06 2014 New Revision: 1597788 URL: http://svn.apache.org/r1597788 Log: Vote Modified: tomcat/tc6.0.x/trunk/STATUS.txt Modified: tomcat/tc6.0.x/trunk/STATUS.txt URL:

buildbot failure in ASF Buildbot on tomcat-7-trunk

2014-05-27 Thread buildbot
The Buildbot has detected a new failure on builder tomcat-7-trunk while building ASF Buildbot. Full details are available at: http://ci.apache.org/builders/tomcat-7-trunk/builds/86 Buildbot URL: http://ci.apache.org/ Buildslave for this Build: bb-vm_ubuntu Build Reason: scheduler Build Source

[Bug 56546] Improve thread trace logging in WebappClassLoader.clearReferencesThreads()

2014-05-27 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56546 --- Comment #5 from Mark Thomas ma...@apache.org --- Is there anything more to do here? If not, I'll resolve this as fixed. -- You are receiving this mail because: You are the assignee for the bug.

[Bug 56546] Improve thread trace logging in WebappClassLoader.clearReferencesThreads()

2014-05-27 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56546 --- Comment #6 from Konstantin Kolinko knst.koli...@gmail.com --- (In reply to Mark Thomas from comment #5) I am OK to treat this as enhancement, though Remy raised this as a serious issue. In any case it is not a stopper for tagging

[Bug 56546] Improve thread trace logging in WebappClassLoader.clearReferencesThreads()

2014-05-27 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56546 Remy Maucherat r...@apache.org changed: What|Removed |Added Priority|P2 |P1

buildbot failure in ASF Buildbot on tomcat-trunk

2014-05-27 Thread buildbot
The Buildbot has detected a new failure on builder tomcat-trunk while building ASF Buildbot. Full details are available at: http://ci.apache.org/builders/tomcat-trunk/builds/114 Buildbot URL: http://ci.apache.org/ Buildslave for this Build: bb-vm_ubuntu Build Reason: scheduler Build Source

[Bug 56561] NoSuchElementException on empty attribute in Validator$ValidateVisitor.getJspAttribute(Validator.java:1385)

2014-05-27 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56561 --- Comment #4 from Violeta Georgieva violet...@apache.org --- I also plan another 7.0.x release at the beginning of the next month. -- You are receiving this mail because: You are the assignee for the bug.

svn commit: r1597837 - in /tomcat/tc6.0.x/trunk: ./ STATUS.txt java/org/apache/jasper/compiler/Validator.java webapps/docs/changelog.xml

2014-05-27 Thread violetagg
Author: violetagg Date: Tue May 27 17:51:17 2014 New Revision: 1597837 URL: http://svn.apache.org/r1597837 Log: Merged revision 1597532 from tomcat/trunk: Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=56561 Fixed NoSuchElementException when an attribute has empty string as value.

[Bug 56561] NoSuchElementException on empty attribute in Validator$ValidateVisitor.getJspAttribute(Validator.java:1385)

2014-05-27 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56561 Violeta Georgieva violet...@apache.org changed: What|Removed |Added Status|NEW |RESOLVED

Re: [SECURITY] CVE-2014-0095 Apache Tomcat denial of service

2014-05-27 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 All, On 5/27/14, 8:46 AM, Mark Thomas wrote: CVE-2014-0095 Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat 8.0.0-RC2 to 8.0.3 Description: A regression was introduced in

Re: [SECURITY] CVE-2014-0097 Apache Tomcat information disclosure

2014-05-27 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 All, On 5/27/14, 8:46 AM, Mark Thomas wrote: CVE-2014-0097 Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat 8.0.0-RC1 to 8.0.3 - Apache Tomcat 7.0.0 to 7.0.52 - Apache

svn commit: r1597855 - in /tomcat/trunk: java/org/apache/tomcat/util/descriptor/web/ApplicationListener.java webapps/docs/changelog.xml

2014-05-27 Thread violetagg
Author: violetagg Date: Tue May 27 19:32:11 2014 New Revision: 1597855 URL: http://svn.apache.org/r1597855 Log: Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=55282 o.a.t.util.descriptor.web.ApplicationListener overrides equals and hashCode methods. Modified:

svn commit: r1597858 - in /tomcat/tc7.0.x/trunk: ./ java/org/apache/catalina/deploy/ApplicationListener.java webapps/docs/changelog.xml

2014-05-27 Thread violetagg
Author: violetagg Date: Tue May 27 19:45:55 2014 New Revision: 1597858 URL: http://svn.apache.org/r1597858 Log: Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=55282 Merged revision 1597855 from tomcat/trunk: o.a.t.util.descriptor.web.ApplicationListener overrides equals and hashCode

[Bug 55282] JSF PhaseListeners are duplicated

2014-05-27 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=55282 Violeta Georgieva violet...@apache.org changed: What|Removed |Added Status|REOPENED|RESOLVED

Tomcat cipher suite config. Was: Tomcat 7 cannot get ciphers with SHA256 or SHA384

2014-05-27 Thread Tim Whittington
Switching to dev list… I’m using the interactive mode of https://github.com/timw/groktls to dump these. Cool. I was just using the SSLInfo class and grep, obviously :) I've been thinking that the way Tomcat does JSSE cipher suites is a bit ... verbose. It would be nice to roll

Re: Tomcat cipher suite config. Was: Tomcat 7 cannot get ciphers with SHA256 or SHA384

2014-05-27 Thread Konstantin Kolinko
2014-05-28 1:35 GMT+04:00 Tim Whittington t...@apache.org: Switching to dev list… I’m using the interactive mode of https://github.com/timw/groktls to dump these. Cool. I was just using the SSLInfo class and grep, obviously :) I've been thinking that the way Tomcat does JSSE cipher suites

Re: Tomcat cipher suite config. Was: Tomcat 7 cannot get ciphers with SHA256 or SHA384

2014-05-27 Thread Tim Whittington
On 28/05/2014, at 9:48 am, Konstantin Kolinko knst.koli...@gmail.com wrote: 2014-05-28 1:35 GMT+04:00 Tim Whittington t...@apache.org: Switching to dev list… I’m using the interactive mode of https://github.com/timw/groktls to dump these. Cool. I was just using the SSLInfo class and

[Bug 56568] Incompatible change in JSPs only permit GET POST or HEAD

2014-05-27 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56568 --- Comment #2 from Mark Thomas ma...@apache.org --- My original proposal [1] included a page directive to make this configurable. That part was rejected. Options at this point: 1. Go ahead and add the page directive anyway 2. Add an init

[Bug 56568] Incompatible change in JSPs only permit GET POST or HEAD

2014-05-27 Thread bugzilla
https://issues.apache.org/bugzilla/show_bug.cgi?id=56568 --- Comment #3 from Konstantin Kolinko knst.koli...@gmail.com --- The specification requirement is not to reject, but to provide undefined behaviour. The rejection behaviour is a security hardening. (In reply to Mark Thomas from comment

Re: [SECURITY] CVE-2014-0119 Apache Tomcat information disclosure

2014-05-27 Thread Konstantin Kolinko
2014-05-27 16:46 GMT+04:00 Mark Thomas ma...@apache.org: CVE-2014-0119 Information Disclosure Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat 8.0.0-RC1 to 8.0.5 - Apache Tomcat 7.0.0 to 7.0.53 - Apache Tomcat 6.0.0 to 6.0.39 Description:

svn commit: r1597913 - in /tomcat/site/trunk: docs/security-6.html docs/security-7.html docs/security-8.html xdocs/security-6.xml xdocs/security-7.xml xdocs/security-8.xml

2014-05-27 Thread kkolinko
Author: kkolinko Date: Wed May 28 00:51:50 2014 New Revision: 1597913 URL: http://svn.apache.org/r1597913 Log: Amend revision lists for CVE-2014-0119 Modified: tomcat/site/trunk/docs/security-6.html tomcat/site/trunk/docs/security-7.html tomcat/site/trunk/docs/security-8.html