Tomcat 8.0.32 has ClassLoader Issues

[Matthias Braun]

[Impact]

 * There was a software bug in the 8.0.32 release of tomcat8, subsequently fixed in 8.0.33, with acessing past the end of a string.

[Test Case]

 * The apache bug provides a test case.

[Regression Potential]

* This is a strict backport from upstream of a bugfix. The regression potential is very low, as the current tomcat8 code is broken.

---

Tomcat 8.0.32, which is shipped with xenial, has serious ClassLoader issues (https://bz.apache.org/bugzilla/show_bug.cgi?id=58999)

Please provide a newer version through the packages.

[Nish Aravamudan (nacc)]

Bugfix is: http://svn.apache.org/viewvc/tomcat/tc8.0.x/trunk/java/org/apache/catalina/loader/WebappClassLoaderBase.java?r1=1726672&r2=1730178&diff_format=h

Can be backported.

[Nish Aravamudan (nacc)]

Yakkety: 8.0.37-1
Zesty: 8.0.38-2 (with 8.5.9-1 in z-p)

We will take a look at backporting the suggested change to 8.0.32, as appropriate. Thank you for the report!

[Nish Aravamudan (nacc)]

Please test tomcat8 https://launchpad.net/~nacc/+archive/ubuntu/tomcat8v2 8.0.32-1ubuntu1.3~ppa1.

[Thomas Mortagne (thomas-mortagne)]

Any news on xenial upgrade ?

[Thomas Mortagne (thomas-mortagne)]

Note that this bug makes pretty much impossible to use Jython in a web app on Xenial.

[Thomas Mortagne (thomas-mortagne)]

Note: I have several people reported that it works well with https://launchpad.net/~nacc/+archive/ubuntu/tomcat8v2 so it would be great to apply it in the default repository :)

[Jean-Sebastien Bevilacqua (realitix)]

Hello Nish Aravamudan,

I encounter this problem on Xenial.
Can you patch it like you did for Yakkety ?

Thanks,
Jean-Sébastien

[Jean-Sebastien Bevilacqua (realitix)]

Hello Nish Aravamudan,

We tried your package on Xenial and it fixes our problem.
Can you release it ?

Thanks,
Jean-Sébastien BEVILACQUA

[Jean-Sebastien Bevilacqua (realitix)]

Hello,

A polite ping.

Thanks,
Jean-Sébastien BEVILACQUA

[Lucas Kanashiro (lucaskanashiro)]

This bug was already fixed in Xenial on version 8.0.32-1ubuntu1.9:

tomcat8 (8.0.32-1ubuntu1.9) xenial; urgency=medium

  * d/p/fix-class-resource-name-filtering.patch: Fix class and resource name
    filtering in WebappClassLoader (LP: #1606331).

 -- Karl Stenerud <email address hidden> Mon, 10 Dec 2018 15:08:07 +0100

And it also seems a dup of LP #1606331. I am updating the status of this bug to Fix Released in Xenial.