Accepted tomcat8 8.5.54-0+deb9u3 (source all) into oldstable
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 22 Jul 2020 17:22:27 +0200
Source: tomcat8
Binary: tomcat8-common tomcat8 tomcat8-user libtomcat8-java libtomcat8-embed-java libservlet3.1-java libservlet3.1-java-doc tomcat8-admin tomcat8-examples tomcat8-docs
Architecture: source all
Version: 8.5.54-0+deb9u3
Distribution: stretch-security
Urgency: high
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Markus Koschany <apo@debian.org>
Description:
libservlet3.1-java - Servlet 3.1, JSP 2.3, EL 3.0 and WebSocket 1.0 Java API classes
libservlet3.1-java-doc - Servlet 3.1, JSP 2.3, EL 3.0 and WebSocket 1.0 Java API documenta
libtomcat8-embed-java - Apache Tomcat 8 - Servlet and JSP engine -- embed libraries
libtomcat8-java - Apache Tomcat 8 - Servlet and JSP engine -- core libraries
tomcat8 - Apache Tomcat 8 - Servlet and JSP engine
tomcat8-admin - Apache Tomcat 8 - Servlet and JSP engine -- admin web application
tomcat8-common - Apache Tomcat 8 - Servlet and JSP engine -- common files
tomcat8-docs - Apache Tomcat 8 - Servlet and JSP engine -- documentation
tomcat8-examples - Apache Tomcat 8 - Servlet and JSP engine -- example web applicati
tomcat8-user - Apache Tomcat 8 - Servlet and JSP engine -- tools to create user
Changes:
tomcat8 (8.5.54-0+deb9u3) stretch-security; urgency=high
.
* Non-maintainer upload by the LTS team.
* Fix CVE-2020-13934:
An h2c direct connection to Apache Tomcat did not release the HTTP/1.1
processor after the upgrade to HTTP/2. If a sufficient number of such
requests were made, an OutOfMemoryException could occur leading to a denial
of service.
* Fix CVE-2020-13935:
The payload length in a WebSocket frame was not correctly validated in
Apache Tomcat. Invalid payload lengths could trigger an infinite loop.
Multiple requests with invalid payload lengths could lead to a denial of
service.
Checksums-Sha1:
d3708d39c3042da0d688f1790b86979e4b4916c7 3101 tomcat8_8.5.54-0+deb9u3.dsc
b0b5fc35ff95b1ea589f6eb81e63855f58200f5d 47116 tomcat8_8.5.54-0+deb9u3.debian.tar.xz
f17599158aeab682bc1dbb44430fc329bc602f40 244068 libservlet3.1-java-doc_8.5.54-0+deb9u3_all.deb
38ac127d4fbcb3862a88e934083eeabe0c128d96 403604 libservlet3.1-java_8.5.54-0+deb9u3_all.deb
86ff731ae714d298e61a832df74b66fc9b474628 4106214 libtomcat8-embed-java_8.5.54-0+deb9u3_all.deb
439e157a1bd808afeb7e1fe1d5ba0c8128c429a0 5362026 libtomcat8-java_8.5.54-0+deb9u3_all.deb
2c7942895d6caf2936b30b51a76d27f372367714 33290 tomcat8-admin_8.5.54-0+deb9u3_all.deb
d6b7a0aabcabfef5ab8fc09e7a32bf3d0692b0a4 67578 tomcat8-common_8.5.54-0+deb9u3_all.deb
7db710a2843f31046f3d120b8cb73ea0d449870f 691124 tomcat8-docs_8.5.54-0+deb9u3_all.deb
4c952c0a5158b9377426cd857f6a55f6052865bd 190060 tomcat8-examples_8.5.54-0+deb9u3_all.deb
81df6ec5236db8067ed3b7fcfdd37941fe7e53d9 41742 tomcat8-user_8.5.54-0+deb9u3_all.deb
f08f7f7a5fdf5c405d6e87f6602c79fc212360d9 53906 tomcat8_8.5.54-0+deb9u3_all.deb
d9c00fdd79db7cfb7df65575256fb1d87a8591fa 14621 tomcat8_8.5.54-0+deb9u3_amd64.buildinfo
Checksums-Sha256:
a5826a316163e3639ba87708b0354bba5bf906cb0559493a9fc68094b86c3cc7 3101 tomcat8_8.5.54-0+deb9u3.dsc
3e9f7416973748044b14e236c0e7faa1708c637e4bcb52d207cdbc300ec6257d 47116 tomcat8_8.5.54-0+deb9u3.debian.tar.xz
b0ba79215f7a9f1fea20dc2adca5f153f0a2bf9ba8f54d85be86433406111002 244068 libservlet3.1-java-doc_8.5.54-0+deb9u3_all.deb
31fc4e0a667b4c943c5a24e79d915fdaf9281e43c90c9228113ae49608bdc3a9 403604 libservlet3.1-java_8.5.54-0+deb9u3_all.deb
394334804b825f98323f2672d4a48f877e4da32f98b886f25cabebb18945eb47 4106214 libtomcat8-embed-java_8.5.54-0+deb9u3_all.deb
1c78ab5ba92cc907de99444c883c12f7f626c739cced0f13de8c035b76a6a385 5362026 libtomcat8-java_8.5.54-0+deb9u3_all.deb
8e0694869eabb5bddc424fd0d807a899c8a93974a3bafda76c7e3b7352f90b60 33290 tomcat8-admin_8.5.54-0+deb9u3_all.deb
c80efd7b5b2d4a59c95359904364e123607832fa4ba31b912c6f5ddb57a7e260 67578 tomcat8-common_8.5.54-0+deb9u3_all.deb
68321b437752f4686840258e3eb9f95cdd06de6eecb5273dc7fa1ddb470118c1 691124 tomcat8-docs_8.5.54-0+deb9u3_all.deb
1fa98e5d31de503dd5ff3cc55d9da1c9e275b09068e030a00d5f68125a36ce96 190060 tomcat8-examples_8.5.54-0+deb9u3_all.deb
7466f1554677fe00efd6f13ca6fdf395c23eb1ed01b1c97e3eec4fe8897c3658 41742 tomcat8-user_8.5.54-0+deb9u3_all.deb
6585b78e99e537f240b3c56068b82676a14288e7009a509001f0bef91687e52c 53906 tomcat8_8.5.54-0+deb9u3_all.deb
06e67dbbd1161c8e2b8327cc748abe173a15976f3e97c79dea5dcba82294cb37 14621 tomcat8_8.5.54-0+deb9u3_amd64.buildinfo
Files:
c7f0bfddfb481c040e386dc9736585a9 3101 java optional tomcat8_8.5.54-0+deb9u3.dsc
75b12825714a6d2e859bfe05f4f22505 47116 java optional tomcat8_8.5.54-0+deb9u3.debian.tar.xz
15fb87bdff7eeae3d03f6368c316d6fd 244068 doc optional libservlet3.1-java-doc_8.5.54-0+deb9u3_all.deb
a4aec35473c2191d6c6b6997a06e539b 403604 java optional libservlet3.1-java_8.5.54-0+deb9u3_all.deb
20a078691f44689f3915953400efb133 4106214 java optional libtomcat8-embed-java_8.5.54-0+deb9u3_all.deb
1b614c726038c5b11930f9c072d32901 5362026 java optional libtomcat8-java_8.5.54-0+deb9u3_all.deb
3a28cc9409d7e9b2b5e2b21439dbad3f 33290 java optional tomcat8-admin_8.5.54-0+deb9u3_all.deb
ceff2ecf3bb2f560941f2a27074f515f 67578 java optional tomcat8-common_8.5.54-0+deb9u3_all.deb
7d2105b0098ee7dbb33eaf523100b290 691124 doc optional tomcat8-docs_8.5.54-0+deb9u3_all.deb
5679bd656c5ea18adf1b9bd01eaf0d08 190060 java optional tomcat8-examples_8.5.54-0+deb9u3_all.deb
467b27d22ab288cdd2e130c74935b35a 41742 java optional tomcat8-user_8.5.54-0+deb9u3_all.deb
5ea8aa2790899a3903e2abfa9eaf08ad 53906 java optional tomcat8_8.5.54-0+deb9u3_all.deb
e220506a92178ebc29c4ddeadba02f43 14621 java optional tomcat8_8.5.54-0+deb9u3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAl8YW1ZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp
YW4ub3JnAAoJENmtFLlRO1HkiGwP/2EeJ+0GmjDi09EtcntLqbrX8lXjFnLqcmac
KB30YW9rfKSG2YFoXEzWUItYO+IqcsdbllE8mHlCVSsEAx7/JgDGXmJ4k5LXxpfP
GioQbwP2kAxbhUPGhhhE2atD5MsmeHhT5HtVAzvVMpmNWz82/L3idBeAZjJ8grk/
6lF9bVDqvjLEb2klVFLa6qfy/EW6jDMGARkfWGoi6JsjAwcXzEcZU+Tn5/7hzW8p
Tdkttf3UJPQVEcZWp2EY/xKmc4tOdJ0XK97xydp1rH3p3mHaP5Rm8qeRnL9DMNDk
qud+7z0ujCUFchNCi5e59LMZZzOfJZregT8nsxEzCMVr7wu8mcfG84U0gDfsAeIn
Z3TshHfGQakksPBOPF5I9SrhOQhmfESV23xym8e+Fh/YMmCnA7xW3DhZ5lnqJ0bb
QZg3i6yzOlyk/kJq0qTWhI7VawCv9D76kMbiRUa/5xtFahcWbn2Uq5UgDvx3m5DI
+XKscOGd0wUzcOnxTQjGtX7vGsmJQN6oBGwfPSUyzgXmrArselupwbbAXlhyqtwC
rvNtXihooZIk5gGNqqIjKrjTipFRTIEXATKd9VqCgUJAi6QtdFAkN6JxmCFNVTlE
F1xj+RDThRp0Y4BXPfZFzdy6b7qP+LUJrSCMzPT/hhbF3ZbGH8W8xxpk5KARzkHp
dT6XeUyF
=Rbw9
-----END PGP SIGNATURE-----