Re: Question about Tomcat 8.5.77 and CVE-2022-0778

2022-03-21 Thread Mark Thomas
On 21/03/2022 16:26, Matthew Mellon wrote: Tomcat 8.5.77 was published on March 17. The Windows distribution contains tcnative-1.dll, version 1.2.31. Tcnative-1.dll appears to be statically linked to OpenSSL, and was built in 2021, prior to the fix for CVE-2022-0778 being published by OpenSSL.

Question about Tomcat 8.5.77 and CVE-2022-0778

2022-03-21 Thread Matthew Mellon
Tomcat 8.5.77 was published on March 17. The Windows distribution contains tcnative-1.dll, version 1.2.31. Tcnative-1.dll appears to be statically linked to OpenSSL, and was built in 2021, prior to the fix for CVE-2022-0778 being published by OpenSSL. The tcnative source tree was updated to "re