Re: Apache/Tomcat vulnerability

2016-11-25 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Artur, On 11/25/16 8:42 AM, Jaaz Portal wrote: > hi, we are from some weeks struggling with some Polish hackers that > are bringing our server down. After updating apache to latest > version (2.4.23) and tomcat (8.0.38) available for debian systems

Re: Apache/Tomcat vulnerability

2016-11-25 Thread Niranjan Babu Bommu
you can find who is flooding site in apache access.log and block them in firewall. ex to find the IP: cat /var/log/apache2/access.log |cut -d' ' -f1 |sort |uniq -c|sort -gr On Fri, Nov 25, 2016 at 8:42 AM, Jaaz Portal wrote: > hi, > we are from some weeks struggling with some Polish hackers

Apache/Tomcat vulnerability

2016-11-25 Thread Jaaz Portal
hi, we are from some weeks struggling with some Polish hackers that are bringing our server down. After updating apache to latest version (2.4.23) and tomcat (8.0.38) available for debian systems we still cannot secure our server. Today it has stopped to respond again and we needed to restart tomc

Thread-safety of javax.servlet.Servlet#getServletConfig()

2016-11-25 Thread Péter Gergely Horváth
Hi All, I am wondering why calling javax.servlet.Servlet#getServletConfig() is thread safe: if you check the implementation in javax.servlet.GenericServlet from servlet API 3.0.1, you see the following: package javax.servlet; // lines omitted public abstract class GenericServlet implements