Thema: Webserversoftware diverses ...

[SiLæncer]

Changelog

Catalina:

Fix: Fix wrong JMX registration regression in 9.0.18. (remm)

Coyote:

Update: Add vectoring for NIO in the base and SSL channels. (remm)
Add: Add asynchronous IO from NIO2 to the NIO connector, with support for the async IO implementations for HTTP/2 and Websockets. The useAsyncIO boolean attribute on the Connector element allows enabling use of the asynchronous IO API. (remm)

Other:

Fix: Ensure that the correct files are included in the source distribution for javacc based parsers depending on whether jjtree is used or not. (markt)
Fix: Ensure that text files in the source distribution have the correct line endings for the target platform. (markt)

[close]

https://tomcat.apache.org/

[SiLæncer]

Changelog

7.0.94

    Fix for CVE-2019-0232, an RCE vulnerability on Windows
    Add support for Java 11 to the JSP compiler. Java 12 and 13 are also now supported if used with a ECJ version with support for those Java versions
    Update Tomcat's packaged-renamed copy of Apache Commons DBCP to the latest DBCP 1.4.x and Pool 1.6.x source (as of 2019-03-15) to pick up various bug fixes

9.0.20 / 8.5.41

    The useAsyncIO boolean attribute on the Connector element value now defaults to true.
    Stack traces written by the OneLineFormatter are fully indented. The entire stack trace is now indented by an additional TAB character.
    Various HTTP/2 improvements and stability fixes.

[close]

https://tomcat.apache.org/

[SiLæncer]

Whats new:>>

    Add user buildable optional modules for easier CDI 2 and JAX-RS support. Also include a new documentation page describing how to use it.
    Update to Tomcat Native 1.2.23 including Windows binaries built with OpenSSL 1.1.1c.
    Update to Eclipse Complier for Java 4.12.

https://tomcat.apache.org/

[SiLæncer]

Whats new:>>

    Expand Graal native image support to include JNDI, JSPs and JULI
    Expand the HTTP/2 excessive overhead protection to cover various forms of abusive client behaviour and close the connection if any such behaviour is detected.
    Security improvements to the Windows installer including a change in the default user from Local System to Local Service.

https://tomcat.apache.org/

[SiLæncer]

Whats new:>>

    Update to Commons Daemon 1.2.1 to pick up fixes for regressions in Commons Daemon 1.2.0, most notably a failure to start when using a 32-bit JVM on Windows.
    Avoid an NPE when accessing an https port using http.
    Fix a potential hang when using HTTP/2 with the asynchronous Servlet API.

https://tomcat.apache.org/

[SiLæncer]

Changelog

9.0.27

The Apache Tomcat Project is proud to announce the release of version 9.0.27 of Apache Tomcat. The notable changes compared to 9.0.26 include:

    Update to Commons Daemon 1.2.2 to pick up the fix for a regression in Commons Daemon 1.2.0 and 1.2.1 that triggered a crash on startup when running on a Windows OS that had not been fully updated.
    Fix some edge cases with NIO2 and TLS that could cause a request to hang.
    Fix a memory leak introduced by the HTTP/2 timeout refactoring in 9.0.23 that could occur when HTTP/2 or WebSocket was used.


8.5.47

The Apache Tomcat Project is proud to announce the release of version 8.5.47 of Apache Tomcat. Apache Tomcat 8.5.x replaces 8.0.x and includes new features pulled forward from Tomcat 9.0.x. The minimum Java version and implemented specification versions remain unchanged. The notable changes compared to 8.5.46 include:

    Update to Commons Daemon 1.2.2 to pick up the fix for a regression in Commons Daemon 1.2.0 and 1.2.1 that triggered a crash on startup when running on a Windows OS that had not been fully updated.
    Fix some edge cases with NIO2 and TLS that could cause a request to hang.

[close]

https://tomcat.apache.org/

[SiLæncer]

Changelog

Catalina

    add   63681: Introduce RealmBase#authenticate(GSSName, GSSCredential) and friends. (michaelo)
    add   63937: Add a new attribute to the standard Authenticator implementations, allowCorsPreflight, that allows the Authenticators to be configured to allow CORS preflight requests to bypass authentication as required by the CORS specification. (markt)
    fix   63939: Correct the same origin check in the CORS filter. An origin with an explicit default port is now considered to be the same as an origin without a default port and origins are now compared in a case-sensitive manner as required by the CORS specification. (markt)
    fix   63950: Fix timing issue in TestAsyncContextStateChanges test that caused it to hang indefinitely. (markt)
    fix   63982: CombinedRealm makes assumptions about principal implementation (michaelo)
    code   Add a unit test for the session FileStore implementation and refactor loops in FileStore to use the ForEach style. Pull request provided by Govinda Sakhare. (markt)
    fix   Refactor FORM authentication to reduce duplicate code and to ensure that the authenticated Principal is not cached in the session when caching is disabled. (markt)
    update   Do not store username and password as session notes during authentication if they are not needed. (kkolinko)

Coyote

    fix   63932: By default, do not compress content that has a strong ETag. This behaviour is configuration for the HTTP/1.1 connectors via the new Connector attribute noCompressionStrongETag. (markt)

WebSocket

    fix   Ensure a very unlikely concurrency issue is avoided when writing WebSocket messages. (markt)

Web applications

    add   Add the ability to set and display session attributes in the JSP FORM authentication example to demonstrate session persistence across restarts for authenticated sessions. (markt)

Other

    fix   Correct the fix for 63815 (quoting the use of CATALINA_OPTS and JAVA_OPTS when used in shell scripts to avoid the expansion of *) as it caused various regressions, particularly with daemon.sh. (markt)
    add   Expand the search made by the Windows installer for a suitable Java installation to include the 64-bit JDK registry entries and the JAVA_HOME environment variable. Pull request provided by Alexander Norz. (markt)
    add   Expand the coverage of the German translations provided with Apache Tomcat. Contribution provided by Jens. (markt)
    add   Expand the coverage of the French translations provided with Apache Tomcat. (remm)
    add   Expand the coverage of the Japanese translations provided with Apache Tomcat. (markt)
    add   Expand the coverage of the Korean translations provided with Apache Tomcat. (woonsan)
    add   Expand the coverage of the Chinese translations provided with Apache Tomcat. Contributions provided by lins and 磊. (markt)
    add   Update the internal fork of Apache Commons BCEL to ff6941e (2019-12-06, 6.4.2-dev). Code clean-up only. (markt)
    add   Update the internal fork of Apache Commons Codec to 9637dd4 (2019-12-06, 1.14-SNAPSHOT). Code clean-up and a fix for CODEC-265. (markt)
    add   Update the internal fork of Apache Commons FileUpload to 2317552 (2019-12-06, 2.0-SNAPSHOT). Refactoring. (markt)

[close]

https://tomcat.apache.org/

[SiLæncer]

Whats new:>>

Coyote

    Fix: 64210: Correct a regression in the improvements to HTTP header validation that caused requests to be incorrectly treated as invalid if a CRLF sequence was split between TCP packets. Improve validation of request lines, including for HTTP/0.9 requests. (markt)

Other

    Fix: 64206: Correct a regression introduced in 8.5.51 that meant that the HTTP port specified when using the Windows Installer was ignored and 8080 was always used. (markt)

https://tomcat.apache.org/

[SiLæncer]

Whats new:>>

Coyote

    Fix: 64210: Correct a regression in the improvements to HTTP header validation that caused requests to be incorrectly treated as invalid if a CRLF sequence was split between TCP packets. Improve validation of request lines, including for HTTP/0.9 requests. (markt)

Other

    Fix: 64206: Correct regression introduced in 9.0.31 that meant that the HTTP port specified when using the Windows Installer was ignored and 8080 was always used. (markt)

https://tomcat.apache.org/

[SiLæncer]

Release Notes : https://downloads.apache.org/httpd/CHANGES_2.4

https://httpd.apache.org/

[SiLæncer]

Whats new:>>

    Statistics are now available (via JMX) for HTTP/2, WebSocket and HTTP/1.1 upgraded connections
    Stability improvements for HTTP/2
    Stability improvements for the NIO connector

https://tomcat.apache.org/

[SiLæncer]

Changelog

    Catalina:

    Ensure the correct escaping of attribute values and search filters in the JNDIRealm. (markt)
    Fix extraction of JAR name in some cases in StandardJarScanner. Submitted by Lynx. (remm)
    Add missing attributes to the MBean descriptor file for the RemoteIpValve. (markt)

    Web applications:

    Correct name of changeLocalName in the documentation for the RemoteIpValve. (markt)

    Other:

    Improvements to Korean translations.
    Improvements to Russian translations.
    Improvements to Chinese translations.
    Improvements to Japanese translations.
    Update the packaged version of the Tomcat Native Library to 1.2.28.

[close]

https://tomcat.apache.org/

[SiLæncer]

Changelog

    Catalina:

    Code: Expand coverage of unit tests for JNDIRealm using the UnboundID LDAP SDK for Java. (markt)
    Fix: 65224: Ensure the correct escaping of attribute values and search filters in the JNDIRealm. (markt)
    Fix: 65235: Add missing attributes to the MBean descriptor file for the RemoteIpValve. (markt)
    Fix: 65244: HandlesTypes should include classes that use the specified annotation types on fields or methods. (remm)
    Fix: 65251: Correct a regression introduced in 8.5.64 that meant that the auto-deployment process may attempt a second, concurrent deployment of a web application that is being deployed by the Manager resulting in one of the deployments failing and errors being reported. (markt)

    Coyote:

    Fix: Ensure that all HTTP requests that contain an invalid character in the protocol component of the request line are rejected with a 400 response rather than some requests being rejected with a 505 response. (markt)
    Fix: When generating the error message for an HTTP request with an invalid request line, ensure that all the available data is included in the error message. (markt)
    Fix: 65272: Restore the optional HTTP feature that allows LF to be treated as a line terminator for the request line and/or HTTP headers lines as well as the standard CRLF. This behaviour was previously removed as a side-effect of the fix for CVE-2020-1935. (markt)

    Jasper:

    Code: Review code used to generate Java source from JSPs and tags and remove code found to be unnecessary. (markt)
    Update: <servlet> entries in web.xml that include a <jsp-file> element and a negative <load-no-startup> element that is not the default value of -1 will no longer be loaded at start-up. This makes it possible to define a <jsp-file> that will not be loaded at start-up. (markt)
    Fix: Allow the JSP configuration option useInstanceManagerForTags to be used with Tags that are implemented as inner classes. (markt)

    WebSocket:

    Code: Refactor the way Tomcat passes path parameters to POJO end points to simplify the code. (markt)
    Fix: 65262: Refactor the creation of WebSocket end point, decoder and encoder instances to be more IoC friendly. Instances are now created via the InstanceManager where possible. (markt)

    Web applications:

    Fix: 65235: Correct name of changeLocalName in the documentation for the RemoteIpValve. (markt)
    Fix: 65265: Avoid getting the boot classpath when it is not available in the Manager diagnostics. (remm)

    Other:

    Update: Update the packaged version of the Tomcat Native Library to 1.2.28. (markt)
    Fix: Move SystemPropertySource to be a regular class to allow more precise configuration if needed. The system property source will still always be enabled. (remm)
    Add: Improvements to Chinese translations. Provided by bytesgo. (mark)
    Add: Improvements to French translations. (remm)
    Add: Improvements to Korean translations. (woonsan)


What's new in Apache Tomcat 9.0.46

    The Apache Tomcat Project is proud to announce the release of version 9.0.46 of Apache Tomcat. This release implements specifications that are part of the Java EE 8 platform. The notable changes compared to 9.0.45 include:
    Ensure the correct escaping of attribute values and search filters in the JNDIRealm.
    HandlesTypes should include classes that use the specified annotation types on fields or methods.
    Refactor the creation of WebSocket end point, decoder and encoder instances to be more IoC friendly. Instances are now created via the InstanceManager where possible.


New in Apache Tomcat 10.0.6

    Ensure the correct escaping of attribute values and search filters in the JNDIRealm.
    HandlesTypes should include classes that use the specified annotation types on fields or methods.
    Refactor the creation of WebSocket end point, decoder and encoder instances to be more IoC friendly. Instances are now created via the InstanceManager where possible.

[close]

https://tomcat.apache.org/

[SiLæncer]

Changelog

    This release implements specifications that are part of the Java EE 7 platform. The notable changes compared to 8.5.78 include:

    Provide a property source that sources values from Kubernetes service bindings. Provided by Sumit Kulhadia and Gareth Evans.
    The root cause of the Linux kernel duplicate accept bug has been identified along with the version of the kernel that includes the fix. The error message displayed when this bug occurs has been updated to reflect this new information and to advise users to update to a version of the OS that uses kernel 5.10 or later. Thanks to Christopher Gual for the research into this issue.
    Update the packaged version of the Tomcat Native Library to 1.2.33 to pick up Windows binaries built with OpenSSL 1.1.1o.
    Add support for encrypted PKCS#1 formatted private keys when configuring the internal, in memory key store.

[close]

https://tomcat.apache.org/

[SiLæncer]

Changelog

    Catalina:

    Fix: 65995: Implement RFC 9239 and use text/javascript as the media type for JavaScript rather than application/javascript. (markt)
    Add: Add an access log valve that uses a json format. Based on pull request #539 provided by Thomas Meyer. (remm)
    Add: Harden the FORM authentication process against DoS attacks by using a reduced session timeout if the FORM authentication process creates a session. The duration of this timeout is configured by the authenticationSessionTimeout attribute of the FORM authenticator. (markt)
    Fix: 66527: Correct the Javadoc for the Tomcat.addWebapp() methods that incorrectly stated that the docBase parameter could be a relative path. (markt)
    Fix: 66524 Correct eviction ordering in WebResource cache to by LRU as intended. (schultz)
    Update: Use server.xml to reduce the default value of maxParameterCount from 10,000 to 1,000. If not configured in server.xml, the default remains 10,000. (markt)
    Add: Update Digest authentication support to align with RFC 7616. This adds a new configuration attribute, algorithms, to the DigestAuthenticator with a default of SHA-256,MD5. (markt)
    Update: Add support code for custom user attributes in RealmBase. Based on code from #473 by Carsten Klein. (remm)
    Fix: Expand the set of HTTP request headers considered sensitive that should be skipped when generating a response to a TRACE request. This aligns with 11.0.x. (markt)
    Fix: 66541: Improve handling for cached resources for resources that use custom URL schemes. The scheme specific equals() and hashcode() algorithms, if present, will now be used for URLs for these resources. This addresses a potential performance issue with some OSGi custom URL schemes that can trigger potentially slow DNS lookups in some configurations. Based on a patch provided by Tom Whitmore. (markt)
    Fix: When using a custom session manager deployed as part of the web application, avoid ClassNotFoundExceptions when validating session IDs extracted from requests. (markt)
    Fix: 66543: Give StandardContext#fireRequestDestroyEvent its own log message. (fschumacher)
    Fix: 66554: Initialize Random during server initialization to avoid possible JVM thread creation in the webapp context on some platforms. (remm)
    Update: Make the server utility executor available to webapps using a Servlet context attribute named org.apache.tomcat.util.threads.ScheduledThreadPoolExecutor. (remm)

    Coyote:

    Fix: JSON filter should support specific escaping for common special characters as defined in RFC 8259. Based on code submitted by Thomas Meyer. (remm)
    Fix: 66511: Fix GzipOutputFilter (used for compressed HTTP responses) when used with direct buffers. Patch suggested by Arjen Poutsma. (markt)
    Fix: 66512: Align AJP handling of invalid HTTP response headers (they are now removed from the response) with HTTP. (markt)
    Fix: 66530: Correct a regression in the fix for bug 66442 that meant that streams without a response body did not decrement the active stream count when completing leading to ERR_HTTP2_SERVER_REFUSED_STREAM for some connections. (markt)
    Code: Refactor synchronization blocks locking on SocketWrapper to use ReentrantLock to support users wishing to experiment with project Loom. (markt)

    Jasper:

    Fix: 66536: Fix parsing of tag files that meant that tag directives could be ignored for some tag files. (markt)

    Cluster:

    Fix: 66535: Redefine the maxValidTime attribute of FarmWarDeployer to be the maximum time allowed between receiving parts of a transferred file before the transfer is cancelled and the associated resources cleaned-up. A new warning message will be logged if the file transfer is cancelled. (markt)

    WebSocket:

    Fix: 66508: When using WebSocket with NIO2, avoid waiting for a timeout before sending the close frame if an I/O error occurs during a write. (markt)

    Other:

    Add: Improvements to French translations. (remm)
    Add: Improvements to Japanese translations. Contributed by Shirayuking and tak7iji. (markt)
    Add: Improvements to Chinese translations. Contributed by totoo. (markt)
    Code: Refactor code using MD5Encoder to use HexUtils.toHexString(). (markt)
    Fix: 66507: Fix a bug that $JAVA_OPTS is not passed to the jvm in catalina.sh when calling version. Patch suggested by Eric Hamilton. (lihan)
    Update: Update the internal fork of Commons DBCP to f131286 (2023-03-08, 2.10.0-SNAPSHOT). This corrects a regression introduced in 9.0.71. (markt)
    Fix: Improve the error messages if JRE_HOME or JAVA_HOME are not set correctly. On windows, align the handling of JRE_HOME and JAVA_HOME for the start-up scripts and the service install script. (markt)
    Update: Update UnboundID to 6.0.8. (markt)
    Update: Update Checkstyle to 10.9.3. (markt)
    Update: Update Jacoco to 0.8.9. (markt)

[close]

https://tomcat.apache.org/