Re: What is the right way to share resources across contexts?

2012-03-27 Thread Mark Thomas
On 27/03/2012 00:04, Christopher Tiwald wrote: Following up on Mark Thomas's advice in my duplicate bug-filing at [2], what is the right way to share static assets across contexts and between servers running tomcat? http://tomcat.apache.org/tomcat-7.0-doc/config/context.html Look for aliases

Re: tomcat dbcp encrption

2012-03-27 Thread Mark Thomas
On 27/03/2012 08:53, 이재만 wrote: hello everybody... somebody help me..please.. how do i encrypt my datasource's user and password in server.xml ?? http://wiki.apache.org/tomcat/FAQ/Password - To unsubscribe, e-mail:

Using CometConnectionManagerValve to detect SESSION_ENDs

2012-03-27 Thread Willem Fibbe - Realworks BV
(Resending with mutt, hoping it will display better) Reading the aio-docs for Tomcat 6 and 7 I see that some CometEvents to be triggered require usage of the org.apache.catalina.valves.CometConnectionManagerValve valve. Am I correct if I say that there are 2 configurations that need to be in

Re: tomcat dbcp encryption

2012-03-27 Thread Ognjen Blagojevic
이재만, On 27.3.2012 9:54, 이재만 wrote: how do i encrypt my datasource's user and password in server.xml ?? Read this: http://wiki.apache.org/tomcat/FAQ/Password -Ognjen - To unsubscribe, e-mail:

Information regarding 12085 - Apache Tomcat servlet/JSP container default files

2012-03-27 Thread Geet Chandra
Hi All, Is there any solution or workaround for protection against this security vulnerability. -Geet

Re: Information regarding 12085 - Apache Tomcat servlet/JSP container default files

2012-03-27 Thread Mark Thomas
On 27/03/2012 14:18, Geet Chandra wrote: Hi All, Is there any solution or workaround for protection against this security vulnerability. What security vulnerability is this? Every published Tomcat security vulnerability has a CVE reference to uniquely identify it. What is the CVE reference

Re: Information regarding 12085 - Apache Tomcat servlet/JSP container default files

2012-03-27 Thread Geet Chandra
Here is the CVE Reference:CVE-2002-2006 On Tue, Mar 27, 2012 at 6:51 PM, Mark Thomas ma...@apache.org wrote: On 27/03/2012 14:18, Geet Chandra wrote: Hi All, Is there any solution or workaround for protection against this security vulnerability. What security vulnerability is this?

Re: Information regarding 12085 - Apache Tomcat servlet/JSP container default files

2012-03-27 Thread Mark Thomas
On 27/03/2012 14:29, Geet Chandra wrote: Here is the CVE Reference:CVE-2002-2006 And the Tomcat version you are using? Mark On Tue, Mar 27, 2012 at 6:51 PM, Mark Thomas ma...@apache.org wrote: On 27/03/2012 14:18, Geet Chandra wrote: Hi All, Is there any solution or workaround for

Re: Information regarding 12085 - Apache Tomcat servlet/JSP container default files

2012-03-27 Thread Geet Chandra
Using Tomcat version 6.0.35 -Geet On Tue, Mar 27, 2012 at 7:02 PM, Mark Thomas ma...@apache.org wrote: On 27/03/2012 14:29, Geet Chandra wrote: Here is the CVE Reference:CVE-2002-2006 And the Tomcat version you are using? Mark On Tue, Mar 27, 2012 at 6:51 PM, Mark Thomas

Re: Information regarding 12085 - Apache Tomcat servlet/JSP container default files

2012-03-27 Thread Mark Thomas
On 27/03/2012 14:38, Geet Chandra wrote: Using Tomcat version 6.0.35 In which case go back and read the vulnerability information again and pay more attention to the part about affected versions. You should also read the Tomcat security pages. Mark -Geet On Tue, Mar 27, 2012 at 7:02

Re: Information regarding 12085 - Apache Tomcat servlet/JSP container default files

2012-03-27 Thread Geet Chandra
I found this information here http://www.westpoint.ltd.uk/example-reports/samplereport_westpoint/files/detail_493213.htm I don't see anything about affected versions. -Geet On Tue, Mar 27, 2012 at 7:20 PM, Mark Thomas ma...@apache.org wrote: On 27/03/2012 14:38, Geet Chandra wrote: Using

Re: Information regarding 12085 - Apache Tomcat servlet/JSP container default files

2012-03-27 Thread Daniel Mikusa
https://tomcat.apache.org/security-4.html#Fixed_in_Apache_Tomcat_4.1.0 or https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2006 The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive

Re: Information regarding 12085 - Apache Tomcat servlet/JSP container default files

2012-03-27 Thread Mark Thomas
Geet Chandra gee...@gmail.com wrote: I found this information here http://www.westpoint.ltd.uk/example-reports/samplereport_westpoint/files/detail_493213.htm I don't see anything about affected versions. Then try reading a proper vulnerability report rather than the output of a

Re: Information regarding 12085 - Apache Tomcat servlet/JSP container default files

2012-03-27 Thread Geet Chandra
This is what I read, now in the solution tab, it says to remove the examples folder,but we are shipping the tomcat with our product, can we remove the example folder and ship with our product.If not, any other workaround/solution.Stoplisted Vulnerabilities for this Host: 2 Vulnerability12085Apache

Re: What is the right way to share resources across contexts?

2012-03-27 Thread Christopher Tiwald
On Tue, Mar 27, 2012 at 09:36:42AM +0100, Mark Thomas wrote: On 27/03/2012 00:04, Christopher Tiwald wrote: Following up on Mark Thomas's advice in my duplicate bug-filing at [2], what is the right way to share static assets across contexts and between servers running tomcat?

Re: Java 7 + Tomcat 6.0.35 + Win2k3 Problem

2012-03-27 Thread pricyber
I've confirm that -Djava.net.preferIPv4Stack=true made no difference to the Java 7 setup. -- View this message in context: http://tomcat.10.n6.nabble.com/Java-7-Tomcat-6-0-35-Win2k3-Problem-tp4566739p4661984.html Sent from the Tomcat - User mailing list archive at Nabble.com.

Re: Information regarding 12085 - Apache Tomcat servlet/JSP container default files

2012-03-27 Thread Pid
On 27/03/2012 15:28, Geet Chandra wrote: This is what I read, now in the solution tab, it says to remove the examples folder,but we are shipping the tomcat with our product, can we remove the example folder and ship with our product.If not, any other workaround/solution.Stoplisted

Examples folder in Tomcat v6.0.35

2012-03-27 Thread Geet Chandra
Hi, My scenario is like this We have product, which ships Apache Tomcat v6.0.35 along with. Is that allowed to ship Apache Tomcat v6.0.35 without examples folder, I mean examples folder being deleted. - Geet