RE: Tomcat 4.0-beta-2 Security Vulnerability

2001-04-03 Thread GOMEZ Henri
I suggest that we create a revised version of beta 2, clearly labelled so that people will know whether they have the corrected version or not -- and we should do this immediately (like today) to minimize the number of people who end up downloading twice. I suggest we call the updated

Tomcat 4.0-beta-2 Security Vulnerability

2001-04-02 Thread Craig R. McClanahan
As you've seen from bug reports to [EMAIL PROTECTED], the Beta 2 release of Tomcat 4.0 has a security vulnerability that can expose JSP file source code. A partial fix to this problem was implemented prior to shipping beta 2, but it did not deal with all possible causes. The actual bug (URL

Re: Tomcat 4.0-beta-2 Security Vulnerability

2001-04-02 Thread Glenn Nielsen
Jon Stevens wrote: on 4/2/01 2:20 PM, "Craig R. McClanahan" [EMAIL PROTECTED] wrote: I suggest that we create a revised version of beta 2, clearly labelled so that people will know whether they have the corrected version or not -- and we should do this immediately (like today) to

Re: Tomcat 4.0-beta-2 Security Vulnerability

2001-04-02 Thread Meir Faraj
- Original Message - From: "Glenn Nielsen" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, April 03, 2001 12:39 AM Subject: Re: Tomcat 4.0-beta-2 Security Vulnerability Jon Stevens wrote: on 4/2/01 2:20 PM, "Craig R. McClanahan" [EMAIL PROTECTED] w

Re: Tomcat 4.0-beta-2 Security Vulnerability

2001-04-02 Thread Mel Martinez
--- "Craig R. McClanahan" [EMAIL PROTECTED] wrote: I suggest that we create a revised version of beta 2, clearly labelled so that people will know whether they have the corrected version or not -- and we should do this immediately (like today) to minimize the number of people who end up

Re: Tomcat 4.0-beta-2 Security Vulnerability

2001-04-02 Thread Craig R. McClanahan
On Mon, 2 Apr 2001, Mel Martinez wrote: --- "Craig R. McClanahan" [EMAIL PROTECTED] wrote: I suggest that we create a revised version of beta 2, clearly labelled so that people will know whether they have the corrected version or not -- and we should do this immediately (like

Re: Tomcat 4.0-beta-2 Security Vulnerability

2001-04-02 Thread Punky Tse
03, 2001 7:38 AM Subject: Re: Tomcat 4.0-beta-2 Security Vulnerability On Mon, 2 Apr 2001, Mel Martinez wrote: --- "Craig R. McClanahan" [EMAIL PROTECTED] wrote: I suggest that we create a revised version of beta 2, clearly labelled so that people will kn

Re: Tomcat 4.0-beta-2 Security Vulnerability

2001-04-02 Thread Craig R. McClanahan
it accidentally. Punky Craig - Original Message - From: "Craig R. McClanahan" [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, April 03, 2001 7:38 AM Subject: Re: Tomcat 4.0-beta-2 Security Vulnerability On Mon, 2 Apr 2001, Mel Martinez wrote: --