** Description changed: [ Impact ] This release fixes a number of security issues: - CVEs (11.0.27): + CVE-2026-103119: Important: AJP response mix-up + CVE-2026-101356: Important: HTTP/2 request/response mix-up after error during async processing + CVE-2026-101296: Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms + CVE-2026-93446: Low: Possible TLS 1.3 connection failures + CVE-2026-88041: Low: HTTP/2 trailer header cross-contamination + CVE-2026-74049: Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) + CVE-2026-74048: Low: OpenSSL-FFM FIPS failure does not prevent start-up - CVEs (11.0.26): + CVE-2026-87022: Low: WebSocket message smuggling with per-message-deflate + CVE-2026-86350: Important: Regression in fix for CVE-2026-41293 can trigger request header mix-up + CVE-2026-86248: Moderate: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled + CVE-2026-79677: Moderate: WebSocket DoS due to lost asynchronous write timeout + CVE-2026-78437: Low: HTTP/2 DoS via malformed request + CVE-2026-78383: Important: AJP DoS via missing request body + CVE-2026-77791: Important: DoS via busy wait during WebSocket close + CVE-2026-77762: Low: Stale HPACK emitter injects trailers into recycled pooled Request + CVE-2026-77756: Low: Transfer-Encoding honored for HTTP/1.0 requests + CVE-2026-76183: Important: Bypass of security constraints for WebSocket endpoints + CVE-2026-75973: Low: Cross-context authentication mix-up with Jakarta Authentication configured + CVE-2026-73581: Moderate: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore + CVE-2026-73180: Low: Authenticated WebSocket session survives end of HTTP session - CVEs (11.0.25): + CVE-2026-68763: Important: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset + CVE-2026-68569: Important: Principal lookup could fail open in some cases + CVE-2026-68525: Low: Redirect after FORM authentication may bypass method specific constraints + CVE-2026-66422: Low: Servlet role references can bypass declarative role constraints + CVE-2026-66299: Low: DoS in WebSocket chat example + CVE-2026-65927: Important: RewriteValve [N] restarts at the second rule and may bypass access control + CVE-2026-65905: Low: Limited replay attack possible with DIGEST authentication + CVE-2026-65637: Moderate: HTTP/2 no-authority bypass of strict SNI validation + CVE-2026-65183: Low: TOCTOU when setting specific permissions for Unix Domain Sockets + CVE-2026-65182: Important: Security constraint bypass Release notes: https://tomcat.apache.org/tomcat-11.0-doc/changelog.html [ Test Plan ] Tomcat 11 is tested by both build-time upstream test suite and autopkgtest. In addition to that it is prudent to perform a smoke test: # Launch lxd vm for testing: lxc launch ubuntu-daily:resolute test && lxc exec test bash # Prepare the PPA for testing: - add-apt-repository ppa:rroessler/sru-tomcat-backports + add-apt-repository ppa:vpa1977/tomcat apt update # Install version that has server packages: apt install tomcat11 # or apt install tomcat10 # Check that the server is accessible: curl -fsS http://localhost:8080 # Check to see if libtcnative-2 loaded successfully: journalctl -u tomcat11 | grep “Loaded Apache Tomcat Native library” # Co-installing both tomcat10 and tomcat11 # 1. Start by installing both packages apt install tomcat10 tomcat11 # 2. Change default port within /var/lib/tomcat11/conf/server.xml (or # tomcat10) by replacing ‘port=”8080”’ in the following statement: # <Connector port=”8080” protocol=”HTTP/1.1” # connectionTimeout=”20000” # redirectPort=”8443” # maxParameterCount=”1000” # /> # 3. Restart the service that was changed systemctl restart tomcat11 # 4. Confirm both servers are now accessible curl -fsS http://localhost:8080 # for first service (default port value) curl -fsS http://localhost:8081 # for second service (other port value) [ Where problems could occur ] The regression risk is low, as upstream code is tested both by exhaustive upstream build time test suite and integration autopkgtest. Additional verification is needed for LP: #1964881, per its test plan. [ Other Info ] PPA: ppa:vpa1977/tomcat[1] [1] https://launchpad.net/~vpa1977/+archive/ubuntu/tomcat/+packages
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171577 Title: please update tomcat11 to 11.0.27 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/tomcat11/+bug/2171577/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
