CVE-2015-5345 patch issue on tomcat7

[Stephen Lynch]

7.0.52-1ubuntu0.6 contains the patch for CVE-2015-5345. It adds mapperContextRootRedirectEnabled as a workaround to prevent breaking the current functionality. This fix cannot be used with the current ubuntu patches as it is missing the change to MapperListener.java in revision http://svn.apache.org/viewvc?view=revision&revision=1716860 (bz https://bz.apache.org/bugzilla/show_bug.cgi?id=58765)

Without it, the values specified in context.xml are not passed down to the Mapper.java on startup.

Setting mapperContextRootRedirectEnabled="true" in /etc/tomcat7/context.xml has no effect. Making the same change with 7.0.70 from tomcat.apache.org works perfectly.

[Launchpad Janitor (janitor)]

This bug was fixed in the package tomcat7 - 7.0.52-1ubuntu0.7

---------------
tomcat7 (7.0.52-1ubuntu0.7) trusty-security; urgency=medium

  * SECURITY UPDATE: privilege escalation via insecure init script
    - debian/tomcat7.init: don't follow symlinks when handling the
      catalina.out file.
    - CVE-2016-1240
  * SECURITY REGRESSION: change in behaviour after security update
    (LP: #1609819)
    - debian/patches/CVE-2015-5345-2.patch: fix using the new
      mapperContextRootRedirectEnabled option in
      java/org/apache/catalina/connector/MapperListener.java, change
      mapperContextRootRedirectEnabled default to true in
      java/org/apache/catalina/core/StandardContext.java,
      webapps/docs/config/context.xml. This reverts the change in behaviour
      following the CVE-2015-5345 security update and was also done
      upstream in later releases.

 -- Marc Deslauriers <email address hidden> Fri, 16 Sep 2016 09:19:37 -0400