I'm sorry I have missed the Freeze for a couple of days (the package has
been pushed in debian in time however).
The rationale is:
-For an LTS something "fresh" should be better indeed.
In the new 2 releases mostly (if not all of them) commits are BUG fix only.
I don't see any new feature in the changelog, while I see one (possibly more)
CVE fixed.
For me is better to push, there is many NPE,CVE and other kind of fixes.
Tomcat 6.0.39 (markt)
Catalina
fix 55166: Fix regression that broke XML validation when running on
some Java 5 JVMs. (kkolinko)
Coyote
fix Make the HTTP NIO connector tolerant of whitespace in the
individual values used for the ciphers attribute. (markt)
fix Remove dependency introduced on the jsp-api.jar as part of the
XML validation changes introduced in 6.0.38. (markt)
Jasper
fix Correct several errors in jspxml Schema and DTD. (kkolinko)
Cluster
code Remove an empty TestTwoPhaseCommit test from Tribes. (kkolinko)
Web applications
fix Fix broken link in Jasper How-To documentation. (markt)
fix Align index.html and index.jsp in ROOT web application. Correct
links to specifications and to the Tomcat mailing lists. (kkolinko)
fix Remove second copy of RUNNING.txt from the full-docs
distribution. Some unpacking utilities can't handle multiple copies of a file
with the same name in a directory. (kkolinko)
Other
update Update sample Eclipse IDE project: use JUnit 4 library and
prefer a Java 5 JDK when several JDKs are configured. Cleanup the Ant build
files. (kkolinko)
fix Correct Maven dependencies for individual JAR files. (markt)
Tomcat 6.0.38 (markt) not released
Catalina
fix Ensure that when Tomcat's anti-resource locking features are
used that the temporary copy of the web application and not the original is
removed when the web application stops. (markt/kkolinko)
fix 55019: Fix a potential exception when accessing JSPs while
running under a SecurityManager. (jfclere)
fix 55052: Make JULI's LogManager to additionally look for logging
properties without prefixes if the property cannot be found with a prefix.
(kkolinko)
fix 55266: Ensure that the session ID is parsed from the request
before any redirect as the session ID may need to be encoded as part of the
redirect URL. (markt)
fix 55404: Log warnings about using security roles in web.xml as
warnings. (markt)
fix 55268: Added optional --service-start-wait-time command-line
option to change service start wait time from default of 10 seconds. (schultz)
fix Correctly associate the default resource bundle with the
English locale so that requests that specify an Accept-Language of English
ahead of French, Spanish or Japanese get the English messages they asked for.
(markt)
fix Add missing JavaEE 5 XML schema definitions. (markt)
fix When Catalina parses TLD files, always use a namespace aware
parser to be consistent with how Jasper parses TLD files. The tldNamespaceAware
attribute of the Context is now ignored. (markt)
fix As per section SRV.14.4.3 of the Servlet 2.5 specification, a
namespace aware, validating parser will be used when processing *.tld and
web.xml files if the system property
org.apache.catalina.STRICT_SERVLET_COMPLIANCE is set to true. (markt)
fix Ensure that sessions IDs are not parsed from URLs for Contexts
where disableURLRewriting is true. (markt)
add Add an option to the Context to control the blocking of XML
external entities when parsing XML configuration files and enable this blocking
by default when a security manager is used. The block is implemented via a
custom resolver to enable the logging of any blocked entities. (markt)
fix 56016: When loading resources for XML schema validation, take
account of the possibility that servlet-api.jar and jsp-api.jar may not be
loaded by the same class loader. Patch by Juan Carlos Estibariz. (markt)
Coyote
fix 52811: Fix parsing of Content-Type header in
HttpServletResponse.setContentType(). Introduces a new HTTP header parser that
follows RFC2616. (markt)
fix 54691: Add configuration attribute "sslEnabledProtocols" to
HTTP connector and document it. (Internally this attribute has been already
implemented but not documented, under names "protocols" and "sslProtocols".
Those names of this attribute are now deprecated). (schultz)
fix 54947: Fix the HTTP NIO connector that incorrectly rejected a
request if the CRLF terminating the request line was split across multiple
packets. Patch by Konstantin Preißer. (markt)
fix 55228: Allow web applications to set a HTTP Date header. (markt)
fix Better adherence to RFC2616 for content-length headers. (markt)
fix Add support for limiting the size of chunk extensions when
using chunked encoding. (markt)
fix 55749: Improve the error message when SSLEngine is disabled in
the AprLifecycleListener and SSL is configured for an APR/native connector.
(markt)
fix Avoid possible NPE if a content type is specified without a
character set. (markt)
Jasper
fix 55198: Ensure attribute values in tagx files that include EL
and quoted XML characters are correctly quoted in the output. (markt)
fix 55671: Consistently use the configuration option name
genStringAsCharArray rather than a mixture of genStrAsCharArray and
genStringAsCharArray but retain support for genStrAsCharArray as in
initialisation parameter for the JSP servlet to retain backwards compatibility
with existing configurations. (markt)
fix 55691: Fix javax.el.ArrayELResolver to correctly handle the
case where the base object is an array of primitives. (markt)
fix 55973: Fix processing of XML schemas when validation is enabled
in Jasper. (kkolinko)
Web applications
add Add documentation for
o.a.c.tribes.group.interceptors.TcpFailureDetector. (kfujino)
add Complete the documentation for MessageDispatch15Interceptor.
(kfujino)
add Add to cluster document a description of
notifyLifecycleListenerOnFailure and heartbeatBackgroundEnabled. (kfujino)
fix 55746: Add documentation on the allRolesMode to the
CombinedRealm and LockOutRealm. Patch by Cédric Couralet. (markt)
fix Fix the sample configuration of StaticMembershipInterceptor in
order to prevent warning log. uniqueId must be 16 bytes. (kfujino)
fix 55119: Avoid CVE-2013-1571 when generating Javadoc. (markt)
Other
update Update Maven Central location used to download dependencies at
build time to be repo.maven.apache.org. (kkolinko)
fix 55663: Minor correction to the wording of the NOTICE files to
align them with the requirements for NOTICE files. (violetagg)
fix Add @since markers to the common annotations classes and fix a
few specification compliance issues. (markt)
update Update to Eclipse JDT Compiler 4.3.1. (markt)
update Update the Apache Jakarta JSTL implementation used by the
exmaples web application to 1.1.2. (markt)
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2013-1571
** Changed in: tomcat6 (Ubuntu)
Status: Incomplete => New
--
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to tomcat6 in Ubuntu.
https://bugs.launchpad.net/bugs/1282923
Title:
Sync tomcat6 6.0.39-1 (universe) from Debian unstable (main)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tomcat6/+bug/1282923/+subscriptions
--
Ubuntu-server-bugs mailing list
Ubuntu-server-bugs@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
