This bug was fixed in the package tomcat8 - 8.5.39-1ubuntu1~18.04.1

---------------
tomcat8 (8.5.39-1ubuntu1~18.04.1) bionic; urgency=medium

  [ Matthias Klose ]
  * Backport for OpenJDK 11. LP: #1817567.
    /usr/share/doc/tomcat8/NEWS.gz. LP: #1819721.

  [ Tiago Stürmer Daitx ]
  * debian/tomcat8.service: removed, use the init.d script instead.
    LP: #1819721.
  * debian/tomcat8.init, debian/logging.properties: revert back to the
    conffiles from the previous version; this allows unattended-upgrades
    to update tomcat8 even when local changes are present.
  * debian/series: no longer apply 0023-disable-shutdown-by-socket.patch
    so server.xml conffile is unmodified from previous version.

tomcat8 (8.5.39-1ubuntu1) disco; urgency=medium

  * Merge with Debian; remaining changes:
    - d/control: Break/replace tomcat8.0 binaries.

tomcat8 (8.5.39-1) experimental; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches
  * Track and download the new releases from GitHub

tomcat8 (8.5.38-2ubuntu1) disco; urgency=medium

  * Merge with Debian; remaining changes:
    - d/control: Break/replace tomcat8.0 binaries.

tomcat8 (8.5.38-2) unstable; urgency=high

  * Team upload.
  * Apply upstream patch to unbreak the startup script (Closes: #922863)

tomcat8 (8.5.38-1ubuntu1) disco; urgency=medium

  * Merge with Debian unstable (LP: #1815601). Remaining changes:
    - d/control: Break/replace tomcat8.0 binaries. (LP: 1717998)
  Dropped Changes:
    - support-jre8.diff.

tomcat8 (8.5.38-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches

tomcat8 (8.5.37-2) unstable; urgency=medium

  * Team upload.
  * No longer build the JavaEE API packages
  * Standards-Version updated to 4.3.0

tomcat8 (8.5.37-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches

tomcat8 (8.5.35-3) unstable; urgency=medium

  * Team upload.
  * Split libservlet3.1-java into separate JavaEE API packages
    (libjsp-api-java, libel-api-java and libwebsocket-api-java)
  * Updated the version required for libtcnative-1 (>= 1.2.18)
  * Install the Russian translation added in Tomcat 8.5.33

tomcat8 (8.5.35-2) unstable; urgency=medium

  * Team upload.
  * Fixed the build failure with Easymock 4 (Closes: #913402)

tomcat8 (8.5.35-1) unstable; urgency=medium

  * Team upload.

  [ Thomas Opfer ]
  * Removed old version requirement for package ant-optional that is not
    required any more.

  [ Emmanuel Bourg ]
  * New upstream release
    - Refreshed the patches

tomcat8 (8.5.34-1ubuntu1) cosmic; urgency=medium

  * Merge from Debian unstable.  Remaining changes:
    - control: Break/replace tomcat8.0 binaries. (LP: #1717998)
    - support-jre8.diff.

tomcat8 (8.5.34-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches

tomcat8 (8.5.33-1) unstable; urgency=medium

  * Team upload.
  * New upstream version 8.5.33.
    - Tomcat compiles to Java 7 bytecode and passes release=7 to javac now.
      This ensures backwards compatibility with older JREs. (Closes: #906447)
  * Declare compliance with Debian Policy 4.2.1.
  * Refresh 0025-invalid-configuration-exit-status.patch.

tomcat8 (8.5.32-2) unstable; urgency=medium

  * Team upload.
  * Added a systemd service file (Closes: #832151, #817909)
  * Look for the Java runtime in the paths used by java-package >= 0.61
    (/usr/lib/jvm/oracle-java<n>-{jre,jdk}-*) (Closes: #894318)
  * Install catalina.policy in the tomcat8-user package to be able to run
    custom instances with a security manager (Closes: #736321)
  * Disabled the shutdown port (8005) by default
  * Updated the policy files in /etc/tomcat8/policy.d/
  * Added the missing Maven rules to use the 8.x generic version for
    tomcat-jaspic-api, tomcat-storeconfig and tomcat-util-scan
  * Set the gecos field when creating the tomcat8 user
  * No longer set JSSE_HOME in the init script (JSSE is enabled by default)
  * Standards-Version updated to 4.2.0

tomcat8 (8.5.32-1ubuntu2) cosmic; urgency=medium

  * Re-introduce and refresh support-jre8.diff - it is still needed.

tomcat8 (8.5.32-1ubuntu1) cosmic; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - control: Break/replace tomcat8.0 binaries. (LP: #1717998)
  * Dropped changes:
    - CVE-2018-8014.patch - superseded upstream.
    - support-jre8.diff - superseded in Debian, by using ant/1.10.3-2.

tomcat8 (8.5.32-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
    - Refreshed the patches

tomcat8 (8.5.31-1) unstable; urgency=medium

  * Team upload.
  * New upstream release
  * Build with ant/1.10.3-2 and the automatic 'release' attribute restoring
    the backward compatibility with Java 7 (Closes: #895866)
  * Search for Java 10 and 11 runtimes
  * Don't follow the symlinks when setting the owner of the /var/log/tomcat8
    and /var/cache/tomcat8 directories in the postinst script
  * Use salsa.debian.org Vcs-* URLs

tomcat8 (8.5.30-1ubuntu3) cosmic; urgency=medium

  * SECURITY UPDATE: CORS filter has insecure defaults
    - debian/patches/CVE-2018-8014.patch: change defaults in
      java/org/apache/catalina/filters/CorsFilter.java,
      java/org/apache/catalina/filters/LocalStrings.properties,
      test/org/apache/catalina/filters/TestCorsFilter.java,
      test/org/apache/catalina/filters/TesterFilterConfigs.java.
    - CVE-2018-8014

tomcat8 (8.5.30-1ubuntu2) cosmic; urgency=medium

  * support-jre8.diff: Fix running tomcat with JRE8. (LP: #1765616)

 -- Tiago Stürmer Daitx <email address hidden>  Wed, 10 Apr 2019 04:45:09 +0000