* SECURITY UPDATE: FORM authentication request injection
- debian/patches/CVE-2013-2067.patch: properly change session ID
in java/org/apache/catalina/authenticator/FormAuthenticator.java.
- CVE-2013-2067
* SECURITY UPDATE: information leak via AsyncListeners and
RuntimeExceptions (LP: #1178645)
- debian/patches/CVE-2013-2071.patch: catch RuntimeExceptions in
java/org/apache/catalina/core/AsyncContextImpl.java, added tests to
test/org/apache/catalina/core/TestAsyncContextImpl.java.
- CVE-2013-2071
* Fix FTBFS due to expired test certificates:
- d/keystores/*.jks: Newer keystores from upstream 7.0.39.
- d/rules: Install newer keystores for testing, tidy up after use.
- d/p/0018-update-test-certificates.patch: Cherry picked fixes from
upstream VCS to update text based certificates.
-- Marc Deslauriers <email address hidden> Thu, 23 May 2013 09:04:36 -0400
This bug was fixed in the package tomcat7 - 7.0.30-0ubuntu1.2
---------------
tomcat7 (7.0.30-0ubuntu1.2) quantal-security; urgency=low
* SECURITY UPDATE: FORM authentication request injection patches/ CVE-2013- 2067.patch: properly change session ID apache/ catalina/ authenticator/ FormAuthenticat or.java. ptions (LP: #1178645) patches/ CVE-2013- 2071.patch: catch RuntimeExceptions in org/apache/ catalina/ core/AsyncConte xtImpl. java, added tests to org/apache/ catalina/ core/TestAsyncC ontextImpl. java. update- test-certificat es.patch: Cherry picked fixes from
- debian/
in java/org/
- CVE-2013-2067
* SECURITY UPDATE: information leak via AsyncListeners and
RuntimeExce
- debian/
java/
test/
- CVE-2013-2071
* Fix FTBFS due to expired test certificates:
- d/keystores/*.jks: Newer keystores from upstream 7.0.39.
- d/rules: Install newer keystores for testing, tidy up after use.
- d/p/0018-
upstream VCS to update text based certificates.
-- Marc Deslauriers <email address hidden> Thu, 23 May 2013 09:04:36 -0400