~ubuntu-branches/ubuntu/maverick/tomcat6/maverick

Committer: Bazaar Package Importer
Author(s): Torsten Werner
Date: 2010-06-28 21:41:31 UTC
mfrom: (2.2.15 sid)
Revision ID: james.westby@ubuntu.com-20100628214131-3wktukpb3lgdf83h

Tags: 6.0.26-5

http://bugs.debian.org/587447

* Convert patches to dep3 format.
* Backport security fix from trunk to fix CVE-2010-1157. (Closes: #587447)
* Set urgency to medium due to the security fix.

files added:
.pc/0001-set-UTF-8-as-default-character-encoding.patch

.pc/0001-set-UTF-8-as-default-character-encoding.patch/conf

.pc/0001-set-UTF-8-as-default-character-encoding.patch/conf/server.xml

.pc/0002-do-not-load-AJP13-connector-by-default.patch

.pc/0002-do-not-load-AJP13-connector-by-default.patch/conf

.pc/0002-do-not-load-AJP13-connector-by-default.patch/conf/server.xml

.pc/0003-disable-APR-library-loading.patch

.pc/0003-disable-APR-library-loading.patch/conf

.pc/0003-disable-APR-library-loading.patch/conf/server.xml

.pc/0004-split-deploy-webapps-target-from-deploy-target.patch

.pc/0004-split-deploy-webapps-target-from-deploy-target.patch/build.xml

.pc/0005-change-default-DBCP-factory-class.patch

.pc/0005-change-default-DBCP-factory-class.patch/java

.pc/0005-change-default-DBCP-factory-class.patch/java/org

.pc/0005-change-default-DBCP-factory-class.patch/java/org/apache

.pc/0005-change-default-DBCP-factory-class.patch/java/org/apache/naming

.pc/0005-change-default-DBCP-factory-class.patch/java/org/apache/naming/factory

.pc/0005-change-default-DBCP-factory-class.patch/java/org/apache/naming/factory/Constants.java

.pc/0005-change-default-DBCP-factory-class.patch/webapps

.pc/0005-change-default-DBCP-factory-class.patch/webapps/docs

.pc/0005-change-default-DBCP-factory-class.patch/webapps/docs/jndi-resources-howto.xml

.pc/0006-add-JARs-below-var-to-class-loader.patch

.pc/0006-add-JARs-below-var-to-class-loader.patch/conf

.pc/0006-add-JARs-below-var-to-class-loader.patch/conf/catalina.properties

.pc/0007-add-OSGi-headers-to-servlet-api.patch

.pc/0007-add-OSGi-headers-to-servlet-api.patch/res

.pc/0007-add-OSGi-headers-to-servlet-api.patch/res/META-INF

.pc/0007-add-OSGi-headers-to-servlet-api.patch/res/META-INF/servlet-api.jar.manifest

.pc/0008-add-OSGI-headers-to-jsp-api.patch

.pc/0008-add-OSGI-headers-to-jsp-api.patch/res

.pc/0008-add-OSGI-headers-to-jsp-api.patch/res/META-INF

.pc/0008-add-OSGI-headers-to-jsp-api.patch/res/META-INF/jsp-api.jar.manifest

.pc/0009-allow-empty-PID-file.patch

.pc/0009-allow-empty-PID-file.patch/bin

.pc/0009-allow-empty-PID-file.patch/bin/catalina.sh

.pc/0010-avoid-deadlock-in-WebappClassLoader.patch

.pc/0010-avoid-deadlock-in-WebappClassLoader.patch/java

.pc/0010-avoid-deadlock-in-WebappClassLoader.patch/java/org

.pc/0010-avoid-deadlock-in-WebappClassLoader.patch/java/org/apache

.pc/0010-avoid-deadlock-in-WebappClassLoader.patch/java/org/apache/catalina

.pc/0010-avoid-deadlock-in-WebappClassLoader.patch/java/org/apache/catalina/loader

.pc/0010-avoid-deadlock-in-WebappClassLoader.patch/java/org/apache/catalina/loader/ResourceEntry.java

.pc/0010-avoid-deadlock-in-WebappClassLoader.patch/java/org/apache/catalina/loader/WebappClassLoader.java

.pc/0010-avoid-deadlock-in-WebappClassLoader.patch/java/org/apache/jasper

.pc/0010-avoid-deadlock-in-WebappClassLoader.patch/java/org/apache/jasper/servlet

.pc/0010-avoid-deadlock-in-WebappClassLoader.patch/java/org/apache/jasper/servlet/JasperLoader.java

.pc/0011-Use-java.security.policy-file-in-catalina.sh.patch

.pc/0011-Use-java.security.policy-file-in-catalina.sh.patch/bin

.pc/0011-Use-java.security.policy-file-in-catalina.sh.patch/bin/catalina.sh

.pc/0012-Prevent-disclosure-of-host-name-or-IP-address.patch

.pc/0012-Prevent-disclosure-of-host-name-or-IP-address.patch/java

.pc/0012-Prevent-disclosure-of-host-name-or-IP-address.patch/java/org

.pc/0012-Prevent-disclosure-of-host-name-or-IP-address.patch/java/org/apache

.pc/0012-Prevent-disclosure-of-host-name-or-IP-address.patch/java/org/apache/catalina

.pc/0012-Prevent-disclosure-of-host-name-or-IP-address.patch/java/org/apache/catalina/authenticator

.pc/0012-Prevent-disclosure-of-host-name-or-IP-address.patch/java/org/apache/catalina/authenticator/AuthenticatorBase.java

.pc/0012-Prevent-disclosure-of-host-name-or-IP-address.patch/java/org/apache/catalina/authenticator/BasicAuthenticator.java

.pc/0012-Prevent-disclosure-of-host-name-or-IP-address.patch/java/org/apache/catalina/authenticator/DigestAuthenticator.java

debian/patches/0001-set-UTF-8-as-default-character-encoding.patch

debian/patches/0002-do-not-load-AJP13-connector-by-default.patch

debian/patches/0003-disable-APR-library-loading.patch

debian/patches/0004-split-deploy-webapps-target-from-deploy-target.patch

debian/patches/0005-change-default-DBCP-factory-class.patch

debian/patches/0006-add-JARs-below-var-to-class-loader.patch

debian/patches/0007-add-OSGi-headers-to-servlet-api.patch

debian/patches/0008-add-OSGI-headers-to-jsp-api.patch

debian/patches/0009-allow-empty-PID-file.patch

debian/patches/0010-avoid-deadlock-in-WebappClassLoader.patch

debian/patches/0011-Use-java.security.policy-file-in-catalina.sh.patch

debian/patches/0012-Prevent-disclosure-of-host-name-or-IP-address.patch

files removed:
.pc/allow-empty-pid-file.patch

.pc/allow-empty-pid-file.patch/bin

.pc/allow-empty-pid-file.patch/bin/catalina.sh

.pc/default-encoding-utf8.patch

.pc/default-encoding-utf8.patch/conf

.pc/default-encoding-utf8.patch/conf/server.xml

.pc/deploy-webapps-build-xml.patch

.pc/deploy-webapps-build-xml.patch/build.xml

.pc/disable-ajp-connector.patch

.pc/disable-ajp-connector.patch/conf

.pc/disable-ajp-connector.patch/conf/server.xml

.pc/disable-apr-loading.patch

.pc/disable-apr-loading.patch/conf

.pc/disable-apr-loading.patch/conf/server.xml

.pc/jsp-api-OSGi.patch

.pc/jsp-api-OSGi.patch/res

.pc/jsp-api-OSGi.patch/res/META-INF

.pc/jsp-api-OSGi.patch/res/META-INF/jsp-api.jar.manifest

.pc/servlet-api-OSGi.patch

.pc/servlet-api-OSGi.patch/res

.pc/servlet-api-OSGi.patch/res/META-INF

.pc/servlet-api-OSGi.patch/res/META-INF/servlet-api.jar.manifest

.pc/use-commons-dbcp.patch

.pc/use-commons-dbcp.patch/java

.pc/use-commons-dbcp.patch/java/org

.pc/use-commons-dbcp.patch/java/org/apache

.pc/use-commons-dbcp.patch/java/org/apache/naming

.pc/use-commons-dbcp.patch/java/org/apache/naming/factory

.pc/use-commons-dbcp.patch/java/org/apache/naming/factory/Constants.java

.pc/use-commons-dbcp.patch/webapps

.pc/use-commons-dbcp.patch/webapps/docs

.pc/use-commons-dbcp.patch/webapps/docs/jndi-resources-howto.xml

.pc/var_loaders.patch

.pc/var_loaders.patch/conf

.pc/var_loaders.patch/conf/catalina.properties

.pc/webapp-classloader-deadlock-fix.patch

.pc/webapp-classloader-deadlock-fix.patch/java

.pc/webapp-classloader-deadlock-fix.patch/java/org

.pc/webapp-classloader-deadlock-fix.patch/java/org/apache

.pc/webapp-classloader-deadlock-fix.patch/java/org/apache/catalina

.pc/webapp-classloader-deadlock-fix.patch/java/org/apache/catalina/loader

.pc/webapp-classloader-deadlock-fix.patch/java/org/apache/catalina/loader/ResourceEntry.java

.pc/webapp-classloader-deadlock-fix.patch/java/org/apache/catalina/loader/WebappClassLoader.java

.pc/webapp-classloader-deadlock-fix.patch/java/org/apache/jasper

.pc/webapp-classloader-deadlock-fix.patch/java/org/apache/jasper/servlet

.pc/webapp-classloader-deadlock-fix.patch/java/org/apache/jasper/servlet/JasperLoader.java

debian/patches/allow-empty-pid-file.patch

debian/patches/default-encoding-utf8.patch

debian/patches/deploy-webapps-build-xml.patch

debian/patches/disable-ajp-connector.patch

debian/patches/disable-apr-loading.patch

debian/patches/jsp-api-OSGi.patch

debian/patches/servlet-api-OSGi.patch

debian/patches/use-commons-dbcp.patch

debian/patches/var_loaders.patch

debian/patches/webapp-classloader-deadlock-fix.patch

files modified:
.pc/applied-patches

bin/catalina.sh

debian/changelog

debian/control

debian/patches/series

debian/tomcat6.init

debian/tomcat6.postinst

java/org/apache/catalina/authenticator/AuthenticatorBase.java

java/org/apache/catalina/authenticator/BasicAuthenticator.java

java/org/apache/catalina/authenticator/DigestAuthenticator.java

Show diffs side-by-side

added added

removed removed

debian/changelog

tomcat6 (6.0.26-5) unstable; urgency=medium

* Convert patches to dep3 format.

* Backport security fix from trunk to fix CVE-2010-1157. (Closes: #587447)

* Set urgency to medium due to the security fix.

-- Torsten Werner <twerner@debian.org> Mon, 28 Jun 2010 21:41:31 +0200

tomcat6 (6.0.26-4) unstable; urgency=low

[ Thierry Carrez ]

* Fix issues preventing from running Tomcat6 with a security manager:

- debian/tomcat6.init: Remove duplicate securitymanager options.

- debian/patches/catalina-sh-security-manager.patch: Use the right

location for the security.policy file in catalina.sh.

- Closes: #585379, LP: #591802. Thanks to Jeff Turner for the original

patches and to Adam Guthrie for the Lucid debdiff.

* Allow binding to any interface when using authbind, rather than only allow

binding to all (LP: #594989)

* Force backgrounding of catalina.sh in start-stop-daemon, to allow the init

script to be started through ssh -t (LP: #588481)

[ Torsten Werner ]

* Remove Paul from Uploaders list.

-- Thierry Carrez <thierry.carrez@ubuntu.com> Thu, 24 Jun 2010 15:55:10 +0200

tomcat6 (6.0.26-3) unstable; urgency=low

[ Marcus Better ]

Older »