[SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack - Status update

2009-12-16 Thread Timir Hazarika
Guys, I just tried patching 6.0.20 with the tomcat6 fix mentioned at http://www.mail-archive.com/users@tomcat.apache.org/msg70131.html This gives me a concurrentmodificationexception: java.util.ConcurrentModificationException at java.util.HashMap$HashIterator.nextEntry(Unknown Source)

Re: [SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack - Status update

2009-12-16 Thread Mark Thomas
On 16/12/2009 14:29, Timir Hazarika wrote: Guys, I just tried patching 6.0.20 with the tomcat6 fix mentioned at http://www.mail-archive.com/users@tomcat.apache.org/msg70131.html This gives me a concurrentmodificationexception: snip/ While this does seem to resolve concurrent

Re: [SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack - Status update

2009-12-16 Thread Timir Hazarika
Mark, I can't seem to find the newer patch, could you share a link please ? Thanks, Timir On Wed, Dec 16, 2009 at 9:42 PM, Mark Thomas ma...@apache.org wrote: On 16/12/2009 14:29, Timir Hazarika wrote: Guys, I just tried patching 6.0.20 with the tomcat6 fix mentioned at

Re: [SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack - Status update

2009-12-16 Thread Timir Hazarika
Never mind - I just figured out what text modifications went into that revision. Mark, any news on 6.0.21 timelines ? Up for release vote yet ? Thanks, Timir On Wed, Dec 16, 2009 at 11:45 PM, Timir Hazarika timir.hazar...@gmail.comwrote: Mark, I can't seem to find the newer patch, could you

Re: [SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack - Status update

2009-12-16 Thread Mark Thomas
On 16/12/2009 20:05, Timir Hazarika wrote: Never mind - I just figured out what text modifications went into that revision. Mark, any news on 6.0.21 timelines ? Up for release vote yet ? Nothing certain but should be soon. Keep an eye on the dev list for any news on tags, release votes etc.

[SECURITY] CVE-2009-3555 SSL Man-In-The-Middle attack - Status update

2009-11-20 Thread Mark Thomas
Overview The purpose of this update is provide information on the current understanding so users are better informed when making decisions regarding risk mitigation for this issue in their environment. Work on the root cause is progressing but is still in a state of flux. Discussion is