ALT-PU-2025-2379: package tomcat update to version 9.0.98-alt0_1jpp17.p10.1
Описание
This update upgrades tomcat to version 9.0.98-alt0_1jpp17.p10.1.
Устраненные уязвимости41
Ссылки24
GHSA-27hp-xhwr-wr2m
https://github.com/advisories/GHSA-27hp-xhwr-wr2mGHSA-2c9m-w27f-53rm
https://github.com/advisories/GHSA-2c9m-w27f-53rmGHSA-5j33-cvvr-w245
https://github.com/advisories/GHSA-5j33-cvvr-w245GHSA-653p-vg55-5652
https://github.com/advisories/GHSA-653p-vg55-5652GHSA-6j88-6whg-x687
https://github.com/advisories/GHSA-6j88-6whg-x687GHSA-7jqf-v358-p8g7
https://github.com/advisories/GHSA-7jqf-v358-p8g7GHSA-7w75-32cg-r6g2
https://github.com/advisories/GHSA-7w75-32cg-r6g2GHSA-f632-9449-3j4w
https://github.com/advisories/GHSA-f632-9449-3j4wGHSA-fccv-jmmp-qg76
https://github.com/advisories/GHSA-fccv-jmmp-qg76GHSA-g8pj-r55q-5c2v
https://github.com/advisories/GHSA-g8pj-r55q-5c2vGHSA-jx7c-7mj5-9438
https://github.com/advisories/GHSA-jx7c-7mj5-9438GHSA-m425-mq94-257g
https://github.com/advisories/GHSA-m425-mq94-257gGHSA-p22x-g9px-3945
https://github.com/advisories/GHSA-p22x-g9px-3945GHSA-q3mw-pvr8-9ggc
https://github.com/advisories/GHSA-q3mw-pvr8-9ggcGHSA-qppj-fm5r-hxr3
https://github.com/advisories/GHSA-qppj-fm5r-hxr3GHSA-qvf5-hvjx-wm27
https://github.com/advisories/GHSA-qvf5-hvjx-wm27GHSA-r6j3-px5g-cq3x
https://github.com/advisories/GHSA-r6j3-px5g-cq3xGHSA-r84p-88g2-2vx2
https://github.com/advisories/GHSA-r84p-88g2-2vx2GHSA-rq2w-37h9-vg94
https://github.com/advisories/GHSA-rq2w-37h9-vg94GHSA-v682-8vv8-vpwr
https://github.com/advisories/GHSA-v682-8vv8-vpwrGHSA-wm9w-rjj3-j356
https://github.com/advisories/GHSA-wm9w-rjj3-j356GHSA-xcpr-7mr4-h4xq
https://github.com/advisories/GHSA-xcpr-7mr4-h4xqGHSA-xpw8-rcwv-8f8p
https://github.com/advisories/GHSA-xpw8-rcwv-8f8pСвязанные уязвимости
ALT-PU-2023-8058: package `tomcat` update to version 9.0.83-alt1_1jpp11
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.