** Description changed: - This bug is to track Tomcat 10 and 11 July update. + [Impact] + + This bug covers July update of tomcat10, tomcat11 and tomcat-native + packages. + + - tomcat10: + - CVEs (10.1.57): + + CVE-2026-59084: Low: EncryptInterceptor requirements not + clearly documented + + CVE-2026-59083: Low: Incorrect URL decoding in RewriteValve + may allow security control bypass + - CVEs (10.1.56): + + CVE-2026-55956: Moderate: Security constraints for default + servlet ignored method + + CVE-2026-55955: Low: EncryptInterceptor not protected against + replay attacks + + CVE-2026-55276: Low: Logged effective web.xml is incomplete + + CVE-2026-53434: Low: Invalid CRL configuration doesn't trigger + failure for FFM Connector + + CVE-2026-53404: Low: Bad ornext processing in RewriteValve + + CVE-2026-50229: Low: XSS in number guess example + - tomcat11: + - CVEs (11.0.24): + + CVE-2026-59084: Low: EncryptInterceptor requirements + not clearly documented + + CVE-2026-59083: Low: Incorrect URL decoding in RewriteValve + may allow security control bypass + - CVEs (11.0.23): + + CVE-2026-55956: Moderate: Security constraints for default + servlet ignored method + + CVE-2026-55955: Low: EncryptInterceptor not protected against + replay attacks + + CVE-2026-55276: Low: Logged effective web.xml is incomplete + + CVE-2026-53434: Low: Invalid CRL configuration doesn't trigger + failure for FFM Connector + + CVE-2026-53404: Low: Bad ornext processing in RewriteValve + + CVE-2026-50229: Low: XSS in number guess example + - tomcat-native 2.0.15 - hard requirement for tomcat11 and contains memory-management fixes: + - Fix: Fix a memory leak when parsing certificates. + Pull request #44 provided by chenjp. + - Fix: Fix two potential memory leaks on error + paths identified by Copilot. + - Fix: 69988: Fix post handshake authentication Tomcat + is configured with a trust store using JSSE style + configuration. + - Fix: 70102: Correct expected size of tickets when calling + SSLContext.setSessionTicketKeys. + + [ Test Plan ] + + All packages implement exhaustive testing at build-time, whilst tomcat10 + and tomcat11 now make these and other smoke tests available through + autopkgtest to ensure tomcat-native compatibility. + + Each of these packages are self-contained and have no reverse + dependencies, and as such their build-time and/or autopkgtest results + should be sufficient. + + For tomcat10 and tomcat11 which produce server packages, these can be + simply tested by confirming that they are running after installation: + + # Launch lxd vm for testing: + lxc launch ubuntu-daily:resolute test && lxc exec test bash + + # Prepare the PPA for testing: + add-apt-repository ppa:rroessler/sru-tomcat-backports + apt update + + # Install version that has server packages: + apt install tomcat11 # or apt install tomcat10 + + # Check that the server is accessible: + curl -fsS http://localhost:8080 + + # Check to see if libtcnative-2 loaded successfully: + journalctl -u tomcat10 | grep “Loaded Apache Tomcat Native library” # or + journalctl -u tomcat11 | grep “Loaded Apache Tomcat Native library” + + # Co-installing both tomcat10 and tomcat11 + # 1. Start by installing both packages + apt install tomcat10 tomcat11 + + # 2. Change default port within /var/lib/tomcat11/conf/server.xml (or + # tomcat10) by replacing ‘port=”8080”’ in the following statement: + # <Connector port=”8080” protocol=”HTTP/1.1” + # connectionTimeout=”20000” + # redirectPort=”8443” + # maxParameterCount=”1000” + # /> + + # 3. Restart the service that was changed + systemctl restart tomcat11 + + # 4. Confirm both servers are now accessible + curl -fsS http://localhost:8080 # for first service (default port value) + curl -fsS http://localhost:8081 # for second service (other port value) + + [ Potential Problems ] + + tomcat11 and tomcat-native updates should be released at the same time, as + tomcat 11.0.24 requires tomcat-native 2.0.15 + + [ Other Info ] + + n/a
** Description changed: [Impact] This bug covers July update of tomcat10, tomcat11 and tomcat-native packages. - tomcat10: - - CVEs (10.1.57): - + CVE-2026-59084: Low: EncryptInterceptor requirements not - clearly documented - + CVE-2026-59083: Low: Incorrect URL decoding in RewriteValve - may allow security control bypass - - CVEs (10.1.56): - + CVE-2026-55956: Moderate: Security constraints for default - servlet ignored method - + CVE-2026-55955: Low: EncryptInterceptor not protected against - replay attacks - + CVE-2026-55276: Low: Logged effective web.xml is incomplete - + CVE-2026-53434: Low: Invalid CRL configuration doesn't trigger - failure for FFM Connector - + CVE-2026-53404: Low: Bad ornext processing in RewriteValve - + CVE-2026-50229: Low: XSS in number guess example + - CVEs (10.1.57): + + CVE-2026-59084: Low: EncryptInterceptor requirements not + clearly documented + + CVE-2026-59083: Low: Incorrect URL decoding in RewriteValve + may allow security control bypass + - CVEs (10.1.56): + + CVE-2026-55956: Moderate: Security constraints for default + servlet ignored method + + CVE-2026-55955: Low: EncryptInterceptor not protected against + replay attacks + + CVE-2026-55276: Low: Logged effective web.xml is incomplete + + CVE-2026-53434: Low: Invalid CRL configuration doesn't trigger + failure for FFM Connector + + CVE-2026-53404: Low: Bad ornext processing in RewriteValve + + CVE-2026-50229: Low: XSS in number guess example - tomcat11: - - CVEs (11.0.24): - + CVE-2026-59084: Low: EncryptInterceptor requirements - not clearly documented - + CVE-2026-59083: Low: Incorrect URL decoding in RewriteValve - may allow security control bypass - - CVEs (11.0.23): - + CVE-2026-55956: Moderate: Security constraints for default - servlet ignored method - + CVE-2026-55955: Low: EncryptInterceptor not protected against - replay attacks - + CVE-2026-55276: Low: Logged effective web.xml is incomplete - + CVE-2026-53434: Low: Invalid CRL configuration doesn't trigger - failure for FFM Connector - + CVE-2026-53404: Low: Bad ornext processing in RewriteValve - + CVE-2026-50229: Low: XSS in number guess example + - CVEs (11.0.24): + + CVE-2026-59084: Low: EncryptInterceptor requirements + not clearly documented + + CVE-2026-59083: Low: Incorrect URL decoding in RewriteValve + may allow security control bypass + - CVEs (11.0.23): + + CVE-2026-55956: Moderate: Security constraints for default + servlet ignored method + + CVE-2026-55955: Low: EncryptInterceptor not protected against + replay attacks + + CVE-2026-55276: Low: Logged effective web.xml is incomplete + + CVE-2026-53434: Low: Invalid CRL configuration doesn't trigger + failure for FFM Connector + + CVE-2026-53404: Low: Bad ornext processing in RewriteValve + + CVE-2026-50229: Low: XSS in number guess example - tomcat-native 2.0.15 - hard requirement for tomcat11 and contains memory-management fixes: - - Fix: Fix a memory leak when parsing certificates. - Pull request #44 provided by chenjp. - - Fix: Fix two potential memory leaks on error - paths identified by Copilot. - - Fix: 69988: Fix post handshake authentication Tomcat - is configured with a trust store using JSSE style - configuration. - - Fix: 70102: Correct expected size of tickets when calling - SSLContext.setSessionTicketKeys. + - Fix: Fix a memory leak when parsing certificates. + Pull request #44 provided by chenjp. + - Fix: Fix two potential memory leaks on error + paths identified by Copilot. + - Fix: 69988: Fix post handshake authentication Tomcat + is configured with a trust store using JSSE style + configuration. + - Fix: 70102: Correct expected size of tickets when calling + SSLContext.setSessionTicketKeys. [ Test Plan ] All packages implement exhaustive testing at build-time, whilst tomcat10 and tomcat11 now make these and other smoke tests available through autopkgtest to ensure tomcat-native compatibility. Each of these packages are self-contained and have no reverse dependencies, and as such their build-time and/or autopkgtest results should be sufficient. For tomcat10 and tomcat11 which produce server packages, these can be simply tested by confirming that they are running after installation: # Launch lxd vm for testing: lxc launch ubuntu-daily:resolute test && lxc exec test bash # Prepare the PPA for testing: add-apt-repository ppa:rroessler/sru-tomcat-backports apt update # Install version that has server packages: apt install tomcat11 # or apt install tomcat10 # Check that the server is accessible: curl -fsS http://localhost:8080 # Check to see if libtcnative-2 loaded successfully: journalctl -u tomcat10 | grep “Loaded Apache Tomcat Native library” # or journalctl -u tomcat11 | grep “Loaded Apache Tomcat Native library” # Co-installing both tomcat10 and tomcat11 # 1. Start by installing both packages apt install tomcat10 tomcat11 # 2. Change default port within /var/lib/tomcat11/conf/server.xml (or # tomcat10) by replacing ‘port=”8080”’ in the following statement: # <Connector port=”8080” protocol=”HTTP/1.1” # connectionTimeout=”20000” # redirectPort=”8443” # maxParameterCount=”1000” # /> # 3. Restart the service that was changed systemctl restart tomcat11 # 4. Confirm both servers are now accessible curl -fsS http://localhost:8080 # for first service (default port value) curl -fsS http://localhost:8081 # for second service (other port value) [ Potential Problems ] tomcat11 and tomcat-native updates should be released at the same time, as tomcat 11.0.24 requires tomcat-native 2.0.15 [ Other Info ] - n/a + tomcat10, tomcat11 and tomcat-native are changelog-only uploads. + + tomcat10 upload to noble removes libeclipse-jdt-core-compiler-batch- + java + + diff --git a/debian/control b/debian/control + index 79d9a103..281ff969 100644 + --- a/debian/control + +++ b/debian/control + @@ -20,7 +20,6 @@ Build-Depends: + libderby-java, + libeasymock-java (>= 3.0), + libeclipse-jdt-core-java (>= 3.26.0), + - libeclipse-jdt-core-compiler-batch-java, + libhamcrest-java (>= 1.3), + libjaxrpc-api-java, + libobjenesis-java, + + The package is not present in noble and is optional it improves jsp + compilation speed, but the user can configure tomcat to use javac for + JSP compilation. ** Description changed: [Impact] This bug covers July update of tomcat10, tomcat11 and tomcat-native packages. - tomcat10: - CVEs (10.1.57): + CVE-2026-59084: Low: EncryptInterceptor requirements not clearly documented + CVE-2026-59083: Low: Incorrect URL decoding in RewriteValve may allow security control bypass - CVEs (10.1.56): + CVE-2026-55956: Moderate: Security constraints for default servlet ignored method + CVE-2026-55955: Low: EncryptInterceptor not protected against replay attacks + CVE-2026-55276: Low: Logged effective web.xml is incomplete + CVE-2026-53434: Low: Invalid CRL configuration doesn't trigger failure for FFM Connector + CVE-2026-53404: Low: Bad ornext processing in RewriteValve + CVE-2026-50229: Low: XSS in number guess example - tomcat11: - CVEs (11.0.24): + CVE-2026-59084: Low: EncryptInterceptor requirements not clearly documented + CVE-2026-59083: Low: Incorrect URL decoding in RewriteValve may allow security control bypass - CVEs (11.0.23): + CVE-2026-55956: Moderate: Security constraints for default servlet ignored method + CVE-2026-55955: Low: EncryptInterceptor not protected against replay attacks + CVE-2026-55276: Low: Logged effective web.xml is incomplete + CVE-2026-53434: Low: Invalid CRL configuration doesn't trigger failure for FFM Connector + CVE-2026-53404: Low: Bad ornext processing in RewriteValve + CVE-2026-50229: Low: XSS in number guess example - - tomcat-native 2.0.15 - hard requirement for tomcat11 and contains memory-management fixes: + - tomcat-native 2.0.15 - hard requirement for tomcat10 and tomcat11 and contains memory-management fixes: - Fix: Fix a memory leak when parsing certificates. Pull request #44 provided by chenjp. - Fix: Fix two potential memory leaks on error paths identified by Copilot. - Fix: 69988: Fix post handshake authentication Tomcat is configured with a trust store using JSSE style configuration. - Fix: 70102: Correct expected size of tickets when calling SSLContext.setSessionTicketKeys. [ Test Plan ] All packages implement exhaustive testing at build-time, whilst tomcat10 and tomcat11 now make these and other smoke tests available through autopkgtest to ensure tomcat-native compatibility. Each of these packages are self-contained and have no reverse dependencies, and as such their build-time and/or autopkgtest results should be sufficient. For tomcat10 and tomcat11 which produce server packages, these can be simply tested by confirming that they are running after installation: # Launch lxd vm for testing: lxc launch ubuntu-daily:resolute test && lxc exec test bash # Prepare the PPA for testing: add-apt-repository ppa:rroessler/sru-tomcat-backports apt update # Install version that has server packages: apt install tomcat11 # or apt install tomcat10 # Check that the server is accessible: curl -fsS http://localhost:8080 # Check to see if libtcnative-2 loaded successfully: journalctl -u tomcat10 | grep “Loaded Apache Tomcat Native library” # or journalctl -u tomcat11 | grep “Loaded Apache Tomcat Native library” # Co-installing both tomcat10 and tomcat11 # 1. Start by installing both packages apt install tomcat10 tomcat11 # 2. Change default port within /var/lib/tomcat11/conf/server.xml (or # tomcat10) by replacing ‘port=”8080”’ in the following statement: # <Connector port=”8080” protocol=”HTTP/1.1” # connectionTimeout=”20000” # redirectPort=”8443” # maxParameterCount=”1000” # /> # 3. Restart the service that was changed systemctl restart tomcat11 # 4. Confirm both servers are now accessible curl -fsS http://localhost:8080 # for first service (default port value) curl -fsS http://localhost:8081 # for second service (other port value) [ Potential Problems ] tomcat11 and tomcat-native updates should be released at the same time, as tomcat 11.0.24 requires tomcat-native 2.0.15 [ Other Info ] tomcat10, tomcat11 and tomcat-native are changelog-only uploads. tomcat10 upload to noble removes libeclipse-jdt-core-compiler-batch- java diff --git a/debian/control b/debian/control index 79d9a103..281ff969 100644 --- a/debian/control +++ b/debian/control @@ -20,7 +20,6 @@ Build-Depends: - libderby-java, - libeasymock-java (>= 3.0), - libeclipse-jdt-core-java (>= 3.26.0), + libderby-java, + libeasymock-java (>= 3.0), + libeclipse-jdt-core-java (>= 3.26.0), - libeclipse-jdt-core-compiler-batch-java, - libhamcrest-java (>= 1.3), - libjaxrpc-api-java, - libobjenesis-java, + libhamcrest-java (>= 1.3), + libjaxrpc-api-java, + libobjenesis-java, The package is not present in noble and is optional it improves jsp compilation speed, but the user can configure tomcat to use javac for JSP compilation. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161376 Title: Tomcat 10, 11 July updates To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/tomcat-native/+bug/2161376/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
