Sync tomcat8 8.0.36-3 (main) from Debian unstable (main)

[Gianfranco Costamagna]

Please sync tomcat8 8.0.36-3 (main) from Debian unstable (main)

Explanation of the Ubuntu delta and why it can be dropped:
  * SECURITY UPDATE: privilege escalation via insecure init script
    - debian/tomcat8.init: don't follow symlinks when handling the
      catalina.out file.
    - CVE-2016-1240

Fixed in Debian

Changelog entries since current yakkety version 8.0.36-2ubuntu1:

tomcat8 (8.0.36-3) unstable; urgency=high

  * Team upload.
  * Fixed CVE-2016-1240: A flaw in the init.d startup script allows local
    attackers who have gained access to the server in the context of the
    tomcat user through a vulnerability in a web application to replace
    the catalina.out file with a symlink to an arbitrary file on the system,
    potentially leading to a root privilege escalation.
    Thanks to Dawid Golunski for the report.
  * Removed the default 128M heap limit (LP: #568823)
  * Depend on taglibs-standard instead of jakarta-taglibs-standard

 -- Emmanuel Bourg <email address hidden> Wed, 14 Sep 2016 10:20:28 +0200

[Christian Ehrhardt  (paelzer)]

Hi Locutus,
thanks for the report, but this would include this change:
"Depend on taglibs-standard instead of jakarta-taglibs-standard"

That is:
--- tomcat8-8.0.36/debian/control 2016-09-14 09:48:48.000000000 +0200
+++ old/tomcat8-8.0.36/debian/control 2016-08-02 10:50:42.000000000 +0200
@@ -17,8 +17,8 @@
                      libeasymock-java (>= 3.0),
                      libecj-java (>= 3.11.0),
                      libhamcrest-java (>= 1.3),
- libtaglibs-standard-spec-java,
- libtaglibs-standard-impl-java,
+ libjakarta-taglibs-standard-java,
+ libjstl1.1-java,
                      libobjenesis-java,
                      lsb-release,
                      maven-repo-helper
@@ -124,8 +124,8 @@

 Package: tomcat8-examples
 Architecture: all
-Depends: libtaglibs-standard-spec-java,
- libtaglibs-standard-impl-java,
+Depends: libjakarta-taglibs-standard-java,
+ libjstl1.1-java,
          tomcat8-common (>= ${source:Version}),
          ${misc:Depends}
 Description: Apache Tomcat 8 - Servlet and JSP engine -- example web applications

But the former are in main and the new ones only in universe so far:
https://launchpad.net/ubuntu/+source/jakarta-taglibs-standard
https://launchpad.net/ubuntu/+source/taglibs-standard/

I think that kills the current sync request.
Has to be made as delta I think.

[Sebastien Bacher (seb128)]

unsubscribing sponsors since according to previous comment that can't be synced

[Christian Ehrhardt  (paelzer)]

Setting to incomplete just in case nothing might come up anymore so it can expire.
Please feel free to reopen if needed.

[Gianfranco Costamagna (costamagnagianfranco)]

Hi, sorry for stepping in so late, VAC happened :)

I opened a MIR request here
https://bugs.launchpad.net/ubuntu/+source/taglibs-standard/+bug/1627630

I would prefer to keep tomcat8 in sync with Debian :)

[Gianfranco Costamagna (costamagnagianfranco)]

 Sync from Primary Archive for Debian GNU/Linux, requested by Matthias Klose

meh