** Description changed: - tracking bug + [ Impact ] + + This release fixes a number of security issues: + - CVEs (10.1.61): + + CVE-2026-101356: Important: HTTP/2 request/response mix-up after + error during async processing + + CVE-2026-101296: Important: JNDIRealm bind credential validation fails + open for non-GSSAPI SASL mechanisms + + CVE-2026-93446: Low: Possible TLS 1.3 connection failures + + CVE-2026-88041: Low: HTTP/2 trailer header cross-contamination + + CVE-2026-74049: Low: Jasper JSTL <c:redirect> plug-in implementation + omits page abort (SKIP_PAGE) + + CVE-2026-74048: Low: OpenSSL-FFM FIPS failure does not prevent start-up + - CVEs (10.1.60): + + CVE-2026-87022: Low: WebSocket message smuggling with + per-message-deflate + + CVE-2026-86350: Important: Regression in fix for CVE-2026-41293 + can trigger request header mix-up + + CVE-2026-86248: Moderate: Fix for CVE-2026-34500 was incomplete. + OCSP checks sometimes soft-fail with FFM even when soft-fail + is disabled + + CVE-2026-79677: Moderate: WebSocket DoS due to lost asynchronous + write timeout + + CVE-2026-78437: Low: HTTP/2 DoS via malformed request + + CVE-2026-78383: Important: AJP DoS via missing request body + + CVE-2026-77791: Important: DoS via busy wait during WebSocket close + + CVE-2026-77762: Low: Stale HPACK emitter injects trailers into + recycled pooled Request + + CVE-2026-77756: Low: Transfer-Encoding honored for HTTP/1.0 requests + + CVE-2026-76183: Important: Bypass of security constraints for + WebSocket endpoints + + CVE-2026-75973: Low: Cross-context authentication mix-up with Jakarta + Authentication configured + + CVE-2026-73581: Moderate: OpenSSL and OpenSSL-FFM TLS implementations + ignore CRLs when certificate uses a keystore + - CVEs (10.1.59): + + CVE-2026-73180: Low: Authenticated WebSocket session survives + end of HTTP session + + CVE-2026-68763: Important: DoS via allocation leak in HTTP/2 backlog + tracking when a stream is reset + + CVE-2026-68569: Important: Principal lookup could fail + open in some cases + + CVE-2026-68525: Low: Redirect after FORM authentication may bypass + method specific constraints + + CVE-2026-66422: Low: Servlet role references can bypass declarative + role constraints + + CVE-2026-66299: Low: DoS in WebSocket chat example + + CVE-2026-65927: Important: RewriteValve [N] restarts at the second rule + and may bypass access control + + CVE-2026-65905: Low: Limited replay attack possible with DIGEST + authentication + + CVE-2026-65637: Moderate: HTTP/2 no-authority bypass of strict SNI + validation + + CVE-2026-65183: Low: TOCTOU when setting specific permissions for + Unix Domain Sockets + + CVE-2026-65182: Important: Security constraint bypass + + Release notes: https://tomcat.apache.org/tomcat-10.1-doc/changelog.html + + [ Test Plan ] + + Tomcat 10 is tested by both build-time upstream test suite and autopkgtest. + In addition to that it is prudent to perform a smoke test: + + # Launch lxd vm for testing: + lxc launch ubuntu-daily:resolute test && lxc exec test bash + + # Prepare the PPA for testing: + add-apt-repository ppa:vpa1977/tomcat + apt update + + # Install version that has server packages: + apt install tomcat10 + + # Check that the server is accessible: + curl -fsS http://localhost:8080 + + # Check to see if libtcnative-2 loaded successfully: + journalctl -u tomcat10 | grep “Loaded Apache Tomcat Native library” + + # Co-installing both tomcat10 and tomcat11 + # 1. Start by installing both packages + apt install tomcat10 tomcat11 + + # 2. Change default port within /var/lib/tomcat11/conf/server.xml (or + # tomcat10) by replacing ‘port=”8080”’ in the following statement: + # <Connector port=”8080” protocol=”HTTP/1.1” + # connectionTimeout=”20000” + # redirectPort=”8443” + # maxParameterCount=”1000” + # /> + + # 3. Restart the service that was changed + systemctl restart tomcat10 + + # 4. Confirm both servers are now accessible + curl -fsS http://localhost:8080 # for first service (default port value) + curl -fsS http://localhost:8081 # for second service (other port value) + + [ Where problems could occur ] + + The regression risk is low, as upstream code is tested both by + exhaustive upstream build time test suite and integration autopkgtest. + + Additional verification is needed for LP: #1964881, per its test plan. + + [ Other Info ] + + PPA: ppa:vpa1977/tomcat[1] + + [1] https://launchpad.net/~vpa1977/+archive/ubuntu/tomcat/+packages
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171585 Title: please update tomcat10 to 10.1.61 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/tomcat10/+bug/2171585/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
