[Bug 1364067] New: The tomcat-tool-wrapper script is broken
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1364067
Bug ID: 1364067
Summary: The tomcat-tool-wrapper script is broken
Product: Fedora EPEL
Version: el6
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: csutherl(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
extras-qa(a)fedoraproject.org, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net,
tomcat-qe(a)redhat.com, trick(a)vanstaveren.us
Depends On: 1363884, 1363887
+++ This bug was initially created as a clone of Bug #1363887 +++
+++ This bug was initially created as a clone of Bug #1363884 +++
Description of problem:
The tomcat-tool-wrapper provided by the tomcat package doesn't work.
Version-Release number of selected component (if applicable):
tomcat-7.0.65-1.el6.noarch
How reproducible:
Every time.
Steps to Reproduce:
1. Install tomcat via `yum install tomcat`
2. Execute the command and observe:
[coty@localhost tomcat]$ tomcat-tool-wrapper -server
org.apache.catalina.realm.RealmBase -a md5 test
Exception in thread "main" java.lang.NoClassDefFoundError:
org/apache/tomcat/util/ExceptionUtils
at org.apache.catalina.startup.Tool.main(Tool.java:218)
Caused by: java.lang.ClassNotFoundException:
org.apache.tomcat.util.ExceptionUtils
at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:331)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
... 1 more
ABRT problem creation: 'success'
Actual results:
A CNFE is thrown because the ExceptionUtils class is not in the classpath.
Expected results:
[coty@localhost tomcat]$ tomcat-tool-wrapper -server
org.apache.catalina.realm.RealmBase -a md5 test
test:4af3bd7759edac2bd372d04c343aee12f789394ecada8c9ce6fc32555fbf5c76$1$58040d6efb505a5e2bcf7c863968a192
--- Additional comment from Coty Sutherland on 2016-08-03 16:16:57 EDT ---
Unlike the Fedora version (which is tomcat8), this one just needs the following
adjustment:
diff --git a/tomcat-7.0-tool-wrapper.script b/tomcat-7.0-tool-wrapper.script
index 2640ce2..a43568b 100644
--- a/tomcat-7.0-tool-wrapper.script
+++ b/tomcat-7.0-tool-wrapper.script
@@ -34,7 +34,7 @@ export CLASSPATH
MAIN_CLASS="org.apache.catalina.startup.Tool"
BASE_OPTIONS=""
BASE_FLAGS="-Dcatalina.home=\"$CATALINA_HOME\""
-BASE_JARS="commons-daemon tomcat/catalina servlet"
+BASE_JARS="commons-daemon tomcat/catalina servlet tomcat/tomcat-util
tomcat/tomcat-coyote"
# Set parameters
set_classpath $BASE_JARS
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1363884
[Bug 1363884] The tomcat-tool-wrapper script is broken
https://bugzilla.redhat.com/show_bug.cgi?id=1363887
[Bug 1363887] The tomcat-tool-wrapper script is broken
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months
[Bug 1352009] New: CVE-2015-5351 CVE-2016-0714 CVE-2016-0706 CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 CVE-2016-3092 tomcat : multiple security vulnerabilities [epel-6]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1352009
Bug ID: 1352009
Summary: CVE-2015-5351 CVE-2016-0714 CVE-2016-0706
CVE-2015-5345 CVE-2015-5346 CVE-2016-0763
CVE-2016-3092 tomcat: multiple security
vulnerabilities [epel-6]
Product: Fedora EPEL
Version: el6
Component: tomcat
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: ivan.afonichev(a)gmail.com
Reporter: csutherl(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, anemec(a)redhat.com,
csutherl(a)redhat.com, dominik(a)greysector.net,
extras-qa(a)fedoraproject.org, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net,
trick(a)vanstaveren.us
Depends On: 1311102
Blocks: 1265698 (CVE-2015-5174), 1311076 (CVE-2015-5351),
1311082 (CVE-2016-0714), 1311085 (CVE-2015-5346),
1311087 (CVE-2016-0706), 1311089 (CVE-2015-5345),
1311093 (CVE-2016-0763)
+++ This bug was initially created as a clone of Bug #1311102 +++
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
--- Additional comment from Andrej Nemec on 2016-02-23 07:05:55 EST ---
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
=====
# bugfix, security, enhancement, newpackage (required)
type=security
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=1311093,1311102
# Description of your update
notes=Security fix for CVE-2016-0763
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users restart after update
suggest_reboot=False
======
Additionally, you may opt to use the bodhi web interface to submit updates:
https://bodhi.fedoraproject.org/updates/new
--- Additional comment from Dominik 'Rathann' Mierzejewski on 2016-04-07
11:27:05 EDT ---
This also affects EPEL6, where tomcat is at version 7.0.65 (latest is 7.0.68).
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1265698
[Bug 1265698] CVE-2015-5174 tomcat: URL Normalization issue
https://bugzilla.redhat.com/show_bug.cgi?id=1311076
[Bug 1311076] CVE-2015-5351 tomcat: CSRF token leak
https://bugzilla.redhat.com/show_bug.cgi?id=1311082
[Bug 1311082] CVE-2016-0714 tomcat: Security Manager bypass via persistence
mechanisms
https://bugzilla.redhat.com/show_bug.cgi?id=1311085
[Bug 1311085] CVE-2015-5346 tomcat: Session fixation
https://bugzilla.redhat.com/show_bug.cgi?id=1311087
[Bug 1311087] CVE-2016-0706 tomcat: security manager bypass via
StatusManagerServlet
https://bugzilla.redhat.com/show_bug.cgi?id=1311089
[Bug 1311089] CVE-2015-5345 tomcat: directory disclosure
https://bugzilla.redhat.com/show_bug.cgi?id=1311093
[Bug 1311093] CVE-2016-0763 tomcat: security manager bypass via
setGlobalContext()
https://bugzilla.redhat.com/show_bug.cgi?id=1311102
[Bug 1311102] CVE-2015-5174 CVE-2015-5351 CVE-2016-0714 CVE-2016-0706
CVE-2015-5345 CVE-2015-5346 CVE-2016-0763 tomcat: multiple security
vulnerabilities [fedora-all]
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months
[Bug 1363884] New: The tomcat-tool-wrapper script is broken
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1363884
Bug ID: 1363884
Summary: The tomcat-tool-wrapper script is broken
Product: Fedora
Version: 23
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: csutherl(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net,
trick(a)vanstaveren.us
Description of problem:
The tomcat-tool-wrapper provided by the tomcat package doesn't work.
Version-Release number of selected component (if applicable):
tomcat-8.0.32-5.fc23.noarch
How reproducible:
Every time.
Steps to Reproduce:
1. Install tomcat via `yum install tomcat`
2. Execute the command and observe:
[coty@localhost tomcat]$ tomcat-tool-wrapper -server
org.apache.catalina.realm.RealmBase -a md5 test
Exception in thread "main" java.lang.NoClassDefFoundError:
org/apache/tomcat/util/ExceptionUtils
at org.apache.catalina.startup.Tool.main(Tool.java:218)
Caused by: java.lang.ClassNotFoundException:
org.apache.tomcat.util.ExceptionUtils
at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:331)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
... 1 more
ABRT problem creation: 'success'
Actual results:
A CNFE is thrown because the ExceptionUtils class is not in the classpath.
Expected results:
[coty@localhost tomcat]$ tomcat-tool-wrapper -server
org.apache.catalina.realm.RealmBase -a md5 test
test:4af3bd7759edac2bd372d04c343aee12f789394ecada8c9ce6fc32555fbf5c76$1$58040d6efb505a5e2bcf7c863968a192
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months
[Bug 1347864] New: The systemd service unit does not allow tomcat to shut down gracefully
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1347864
Bug ID: 1347864
Summary: The systemd service unit does not allow tomcat to shut
down gracefully
Product: Fedora
Version: 23
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: csutherl(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net,
tomcat-qe(a)redhat.com, trick(a)vanstaveren.us
Depends On: 1347860
+++ This bug was initially created as a clone of Bug #1347860 +++
Description of problem:
The systemd unit terminates the tomcat process prematurely, therefore not
allowing it to shutdown gracefully. The direct effect of this is that sessions
in the session manager are not persisted to disk and restored after a restart,
resulting in a loss of session data (unless you are replicating data within a
cluster).
Version-Release number of selected component (if applicable):
tomcat-8.0.32-5.fc23.noarch
How reproducible:
Always
Steps to Reproduce:
1. yum install tomcat
2. cp reproducer.war /usr/share/tomcat/webapps/
3. service tomcat start
4. curl http://localhost:8080/reproducer/getSession.jsp
5. service tomcat stop
6. ls /usr/share/tomcat/work/Catalina/localhost/reproducer/SESSIONS.ser
Actual results:
The session created by the curl request is not persisted into SESSIONS.ser.
Expected results:
The session created by the curl request is persisted to SESSIONS.ser
Additional info:
When the process successfully completes (with FINE logging on the
StandardManager (org.apache.catalina.session.StandardManager.level = FINE)),
you see the following along with other shutdown messages:
~~~
Jun 17, 2016 4:45:08 PM org.apache.catalina.session.StandardManager doUnload
FINE: Unloading persisted sessions
Jun 17, 2016 4:45:08 PM org.apache.catalina.session.StandardManager doUnload
FINE: Saving persisted sessions to SESSIONS.ser
Jun 17, 2016 4:45:08 PM org.apache.catalina.session.StandardManager doUnload
FINE: Unloading 4 sessions
Jun 17, 2016 4:45:08 PM org.apache.catalina.session.StandardManager doUnload
FINE: Expiring 4 persisted sessions
Jun 17, 2016 4:45:08 PM org.apache.catalina.session.StandardManager doUnload
FINE: Unloading complete
~~~
When you call the service stop, it terminates before the shutdown can complete
(almost immediately after calling stop):
~~~
INFO: Server startup in 3501 ms
Jun 17, 2016 4:58:20 PM org.apache.catalina.core.StandardServer await
INFO: A valid shutdown command was received via the shutdown port. Stopping the
Server instance.
Jun 17, 2016 4:58:20 PM org.apache.coyote.AbstractProtocol pause
INFO: Pausing ProtocolHandler ["http-bio-8080"]
~~~
--- Additional comment from Coty Sutherland on 2016-06-17 17:07:02 EDT ---
I'm able to get a graceful shutdown if I switch the unit type to Forking
instead of simple, but then the start hangs :(
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1347860
[Bug 1347860] The systemd service unit does not allow tomcat to shut down
gracefully
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months
[Bug 1341850] New: tomcat-jsvc.service has TOMCAT_USER value hard-coded
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1341850
Bug ID: 1341850
Summary: tomcat-jsvc.service has TOMCAT_USER value hard-coded
Product: Fedora
Version: 23
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: csutherl(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
External Bug ID: Red Hat Bugzilla 1201409
Description of problem:
The TOMCAT_USER value should be configurable instead of always "tomcat".
Looking at the way that the service unit executes the tomcat script, I see that
the functions script is sourced in the preamble BEFORE the configuration is
loaded, so even if we check the TOMCAT_USER variable and try and use it, it
would always be empty. Could we move the configuration sourcing before we
source functions to make it configurable?
Version-Release number of selected component (if applicable):
tomcat-8.0.32-5.fc23.noarch
How reproducible:
Always
Steps to Reproduce:
1. Set TOMCAT_USER="notTomcat" in tomcat.conf
2. Start service with jsvc: systemctl start tomcat-jsvc
3. Observe that the process owner is "tomcat" instead of "notTomcat"
Actual results:
Process owner is "tomcat"
Expected results:
Process owner is "notTomcat"
Additional info:
This issue was raised against RHEL in the bug here
https://bugzilla.redhat.com/show_bug.cgi?id=1201409. I'll link it as well.
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months
[Bug 1359737] New: Missing maven depmap for the following artifacts: org.apache.tomcat:tomcat-websocket, org.apache.tomcat: tomcat-websocket-api
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1359737
Bug ID: 1359737
Summary: Missing maven depmap for the following artifacts:
org.apache.tomcat:tomcat-websocket,
org.apache.tomcat:tomcat-websocket-api
Product: Fedora
Version: rawhide
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: puntogil(a)libero.it
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net,
trick(a)vanstaveren.us
Description of problem:
Some packages use (e.g. Apache Johnzon, Spring Framework 4.x ) the
following artifacts as build deps:
org.apache.tomcat:tomcat-websocket, org.apache.tomcat:tomcat-websocket-api
Version-Release number of selected component (if applicable):
tomcat-lib-8.0.32-4.fc24 tomcat-lib-8.0.32-4.fc25
How reproducible:
Always
Expected results:
Please, include tomcat-websocket, and tomcat-websocket-api in maven depmap
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months
[Bug 1357428] New: Tomcat 8.0.32 breaks deploy for candlepin.
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1357428
Bug ID: 1357428
Summary: Tomcat 8.0.32 breaks deploy for candlepin.
Product: Fedora
Version: 24
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: dsarman(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net,
trick(a)vanstaveren.us
External Bug ID: Apache Bugzilla 58999
Description of problem:
Tomcat version 8.0.32 contains bug precluding candlepin from successfully
deploying.
Version-Release number of selected component (if applicable):
8.0.32-4.fc24
How reproducible:
always
Steps to Reproduce:
1.Try to deploy Candlepin server.
Actual results:
Deploy fails with StringIndexOutOfBoundsException.
Expected results:
Deploy succeeds.
Additional info:
According to https://bz.apache.org/bugzilla/show_bug.cgi?id=58999#c7 this
should be resolved in tomcat 8.0.33.
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months
[Bug 1369552] New: javapackages-tools:
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1369552
Bug ID: 1369552
Summary: javapackages-tools:
Product: Fedora
Version: rawhide
Component: javapackages-tools
Keywords: Documentation, FutureFeature
Assignee: mizdebsk(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com
We should make it more clear that packaging HOWTO available online typically
reflects state of rawhide and that documentation for particular system version
can be obtained from /usr/share/doc/javapackages-tools-doc
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 9 months