** Description changed: - tracking bug + [ Impact ] + + This release fixes a number of security issues: + - CVEs (11.0.27): + + CVE-2026-103119: Important: AJP response mix-up + + CVE-2026-101356: Important: HTTP/2 request/response mix-up after error + during async processing + + CVE-2026-101296: Important: JNDIRealm bind credential validation fails + open for non-GSSAPI SASL mechanisms + + CVE-2026-93446: Low: Possible TLS 1.3 connection failures + + CVE-2026-88041: Low: HTTP/2 trailer header cross-contamination + + CVE-2026-74049: Low: Jasper JSTL <c:redirect> plug-in implementation + omits page abort (SKIP_PAGE) + + CVE-2026-74048: Low: OpenSSL-FFM FIPS failure does not prevent start-up + - CVEs (11.0.26): + + CVE-2026-87022: Low: WebSocket message smuggling with + per-message-deflate + + CVE-2026-86350: Important: Regression in fix for CVE-2026-41293 can + trigger request header mix-up + + CVE-2026-86248: Moderate: Fix for CVE-2026-34500 was incomplete. + OCSP checks sometimes soft-fail with FFM even when soft-fail + is disabled + + CVE-2026-79677: Moderate: WebSocket DoS due to lost asynchronous + write timeout + + CVE-2026-78437: Low: HTTP/2 DoS via malformed request + + CVE-2026-78383: Important: AJP DoS via missing request body + + CVE-2026-77791: Important: DoS via busy wait during WebSocket close + + CVE-2026-77762: Low: Stale HPACK emitter injects trailers into + recycled pooled Request + + CVE-2026-77756: Low: Transfer-Encoding honored for HTTP/1.0 requests + + CVE-2026-76183: Important: Bypass of security constraints for WebSocket + endpoints + + CVE-2026-75973: Low: Cross-context authentication mix-up with Jakarta + Authentication configured + + CVE-2026-73581: Moderate: OpenSSL and OpenSSL-FFM TLS implementations + ignore CRLs when certificate uses a keystore + + CVE-2026-73180: Low: Authenticated WebSocket session survives + end of HTTP session + - CVEs (11.0.25): + + CVE-2026-68763: Important: DoS via allocation leak in HTTP/2 backlog + tracking when a stream is reset + + CVE-2026-68569: Important: Principal lookup could fail open + in some cases + + CVE-2026-68525: Low: Redirect after FORM authentication may bypass + method specific constraints + + CVE-2026-66422: Low: Servlet role references can bypass declarative + role constraints + + CVE-2026-66299: Low: DoS in WebSocket chat example + + CVE-2026-65927: Important: RewriteValve [N] restarts at the second rule + and may bypass access control + + CVE-2026-65905: Low: Limited replay attack possible with DIGEST + authentication + + CVE-2026-65637: Moderate: HTTP/2 no-authority bypass of strict + SNI validation + + CVE-2026-65183: Low: TOCTOU when setting specific permissions for + Unix Domain Sockets + + CVE-2026-65182: Important: Security constraint bypass + + Release notes: https://tomcat.apache.org/tomcat-11.0-doc/changelog.html + + [ Test Plan ] + + Tomcat 11 is tested by both build-time upstream test suite and autopkgtest. + In addition to that it is prudent to perform a smoke test: + + # Launch lxd vm for testing: + lxc launch ubuntu-daily:resolute test && lxc exec test bash + + # Prepare the PPA for testing: + add-apt-repository ppa:rroessler/sru-tomcat-backports + apt update + + # Install version that has server packages: + apt install tomcat11 # or apt install tomcat10 + + # Check that the server is accessible: + curl -fsS http://localhost:8080 + + # Check to see if libtcnative-2 loaded successfully: + journalctl -u tomcat10 | grep “Loaded Apache Tomcat Native library” # or + journalctl -u tomcat11 | grep “Loaded Apache Tomcat Native library” + + # Co-installing both tomcat10 and tomcat11 + # 1. Start by installing both packages + apt install tomcat10 tomcat11 + + # 2. Change default port within /var/lib/tomcat11/conf/server.xml (or + # tomcat10) by replacing ‘port=”8080”’ in the following statement: + # <Connector port=”8080” protocol=”HTTP/1.1” + # connectionTimeout=”20000” + # redirectPort=”8443” + # maxParameterCount=”1000” + # /> + + # 3. Restart the service that was changed + systemctl restart tomcat11 + + # 4. Confirm both servers are now accessible + curl -fsS http://localhost:8080 # for first service (default port value) + curl -fsS http://localhost:8081 # for second service (other port value) + + + [ Where problems could occur ] + + The regression risk is low, as upstream code is tested both by + exhaustive upstream build time test suite and integration autopkgtest. + + Additional verification is needed for LP: #1964881, per its test plan. + + [ Other Info ] + + PPA: ppa:vpa1977/tomcat[1] + + [1] https://launchpad.net/~vpa1977/+archive/ubuntu/tomcat/+packages
** Description changed: [ Impact ] This release fixes a number of security issues: - - CVEs (11.0.27): - + CVE-2026-103119: Important: AJP response mix-up - + CVE-2026-101356: Important: HTTP/2 request/response mix-up after error - during async processing - + CVE-2026-101296: Important: JNDIRealm bind credential validation fails - open for non-GSSAPI SASL mechanisms - + CVE-2026-93446: Low: Possible TLS 1.3 connection failures - + CVE-2026-88041: Low: HTTP/2 trailer header cross-contamination - + CVE-2026-74049: Low: Jasper JSTL <c:redirect> plug-in implementation - omits page abort (SKIP_PAGE) - + CVE-2026-74048: Low: OpenSSL-FFM FIPS failure does not prevent start-up - - CVEs (11.0.26): - + CVE-2026-87022: Low: WebSocket message smuggling with - per-message-deflate - + CVE-2026-86350: Important: Regression in fix for CVE-2026-41293 can - trigger request header mix-up - + CVE-2026-86248: Moderate: Fix for CVE-2026-34500 was incomplete. - OCSP checks sometimes soft-fail with FFM even when soft-fail - is disabled - + CVE-2026-79677: Moderate: WebSocket DoS due to lost asynchronous - write timeout - + CVE-2026-78437: Low: HTTP/2 DoS via malformed request - + CVE-2026-78383: Important: AJP DoS via missing request body - + CVE-2026-77791: Important: DoS via busy wait during WebSocket close - + CVE-2026-77762: Low: Stale HPACK emitter injects trailers into - recycled pooled Request - + CVE-2026-77756: Low: Transfer-Encoding honored for HTTP/1.0 requests - + CVE-2026-76183: Important: Bypass of security constraints for WebSocket - endpoints - + CVE-2026-75973: Low: Cross-context authentication mix-up with Jakarta - Authentication configured - + CVE-2026-73581: Moderate: OpenSSL and OpenSSL-FFM TLS implementations - ignore CRLs when certificate uses a keystore - + CVE-2026-73180: Low: Authenticated WebSocket session survives - end of HTTP session - - CVEs (11.0.25): - + CVE-2026-68763: Important: DoS via allocation leak in HTTP/2 backlog - tracking when a stream is reset - + CVE-2026-68569: Important: Principal lookup could fail open - in some cases - + CVE-2026-68525: Low: Redirect after FORM authentication may bypass - method specific constraints - + CVE-2026-66422: Low: Servlet role references can bypass declarative - role constraints - + CVE-2026-66299: Low: DoS in WebSocket chat example - + CVE-2026-65927: Important: RewriteValve [N] restarts at the second rule - and may bypass access control - + CVE-2026-65905: Low: Limited replay attack possible with DIGEST - authentication - + CVE-2026-65637: Moderate: HTTP/2 no-authority bypass of strict - SNI validation - + CVE-2026-65183: Low: TOCTOU when setting specific permissions for - Unix Domain Sockets - + CVE-2026-65182: Important: Security constraint bypass + - CVEs (11.0.27): + + CVE-2026-103119: Important: AJP response mix-up + + CVE-2026-101356: Important: HTTP/2 request/response mix-up after error + during async processing + + CVE-2026-101296: Important: JNDIRealm bind credential validation fails + open for non-GSSAPI SASL mechanisms + + CVE-2026-93446: Low: Possible TLS 1.3 connection failures + + CVE-2026-88041: Low: HTTP/2 trailer header cross-contamination + + CVE-2026-74049: Low: Jasper JSTL <c:redirect> plug-in implementation + omits page abort (SKIP_PAGE) + + CVE-2026-74048: Low: OpenSSL-FFM FIPS failure does not prevent start-up + - CVEs (11.0.26): + + CVE-2026-87022: Low: WebSocket message smuggling with + per-message-deflate + + CVE-2026-86350: Important: Regression in fix for CVE-2026-41293 can + trigger request header mix-up + + CVE-2026-86248: Moderate: Fix for CVE-2026-34500 was incomplete. + OCSP checks sometimes soft-fail with FFM even when soft-fail + is disabled + + CVE-2026-79677: Moderate: WebSocket DoS due to lost asynchronous + write timeout + + CVE-2026-78437: Low: HTTP/2 DoS via malformed request + + CVE-2026-78383: Important: AJP DoS via missing request body + + CVE-2026-77791: Important: DoS via busy wait during WebSocket close + + CVE-2026-77762: Low: Stale HPACK emitter injects trailers into + recycled pooled Request + + CVE-2026-77756: Low: Transfer-Encoding honored for HTTP/1.0 requests + + CVE-2026-76183: Important: Bypass of security constraints for WebSocket + endpoints + + CVE-2026-75973: Low: Cross-context authentication mix-up with Jakarta + Authentication configured + + CVE-2026-73581: Moderate: OpenSSL and OpenSSL-FFM TLS implementations + ignore CRLs when certificate uses a keystore + + CVE-2026-73180: Low: Authenticated WebSocket session survives + end of HTTP session + - CVEs (11.0.25): + + CVE-2026-68763: Important: DoS via allocation leak in HTTP/2 backlog + tracking when a stream is reset + + CVE-2026-68569: Important: Principal lookup could fail open + in some cases + + CVE-2026-68525: Low: Redirect after FORM authentication may bypass + method specific constraints + + CVE-2026-66422: Low: Servlet role references can bypass declarative + role constraints + + CVE-2026-66299: Low: DoS in WebSocket chat example + + CVE-2026-65927: Important: RewriteValve [N] restarts at the second rule + and may bypass access control + + CVE-2026-65905: Low: Limited replay attack possible with DIGEST + authentication + + CVE-2026-65637: Moderate: HTTP/2 no-authority bypass of strict + SNI validation + + CVE-2026-65183: Low: TOCTOU when setting specific permissions for + Unix Domain Sockets + + CVE-2026-65182: Important: Security constraint bypass Release notes: https://tomcat.apache.org/tomcat-11.0-doc/changelog.html [ Test Plan ] - Tomcat 11 is tested by both build-time upstream test suite and autopkgtest. + Tomcat 11 is tested by both build-time upstream test suite and autopkgtest. In addition to that it is prudent to perform a smoke test: # Launch lxd vm for testing: lxc launch ubuntu-daily:resolute test && lxc exec test bash # Prepare the PPA for testing: add-apt-repository ppa:rroessler/sru-tomcat-backports apt update # Install version that has server packages: apt install tomcat11 # or apt install tomcat10 # Check that the server is accessible: curl -fsS http://localhost:8080 # Check to see if libtcnative-2 loaded successfully: - journalctl -u tomcat10 | grep “Loaded Apache Tomcat Native library” # or journalctl -u tomcat11 | grep “Loaded Apache Tomcat Native library” # Co-installing both tomcat10 and tomcat11 # 1. Start by installing both packages apt install tomcat10 tomcat11 # 2. Change default port within /var/lib/tomcat11/conf/server.xml (or # tomcat10) by replacing ‘port=”8080”’ in the following statement: # <Connector port=”8080” protocol=”HTTP/1.1” # connectionTimeout=”20000” # redirectPort=”8443” # maxParameterCount=”1000” # /> # 3. Restart the service that was changed systemctl restart tomcat11 # 4. Confirm both servers are now accessible curl -fsS http://localhost:8080 # for first service (default port value) curl -fsS http://localhost:8081 # for second service (other port value) - [ Where problems could occur ] The regression risk is low, as upstream code is tested both by exhaustive upstream build time test suite and integration autopkgtest. Additional verification is needed for LP: #1964881, per its test plan. [ Other Info ] PPA: ppa:vpa1977/tomcat[1] [1] https://launchpad.net/~vpa1977/+archive/ubuntu/tomcat/+packages -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171577 Title: please update tomcat11 to 11.0.27 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/tomcat11/+bug/2171577/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
