Register | Log in

tomcat-native

Tomcat native library using the Apache Portable Runtime

Choose email to subscribe with

general

source: tomcat-native (main)
version: 1.2.17-1
maintainer: Debian Java Maintainers (archive) [DMD]
uploaders: Damien Raude-Morvan [DMD]
arch: any
std-ver: 4.1.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.1.24-1
o-o-sec: 1.1.24-1+deb7u1
oldstable: 1.1.32~repack-2+deb8u1
old-sec: 1.1.32~repack-2+deb8u1
old-bpo: 1.2.10-1~bpo8+1
stable: 1.2.12-2+deb9u1
stable-sec: 1.2.12-2+deb9u1
stable-bpo: 1.2.17-1~bpo9+1
testing: 1.2.17-1
unstable: 1.2.17-1

versioned links

1.1.24-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.1.24-1+deb7u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.1.32~repack-2+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.10-1~bpo8+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.12-2+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.16-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.17-1~bpo9+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.17-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libtcnative-1

action needed

2 security issues in stretch high

There are 2 open security issues in stretch.

2 important issues:

CVE-2018-8020: Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. Subsequently, revoked client certificates may not be properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS. Users not using OCSP checks are not affected by this vulnerability.
CVE-2018-8019: When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Please fix them.

Created: 2018-08-01 Last update: 2018-08-02 08:08

2 security issues in jessie high

There are 2 open security issues in jessie.

2 important issues:

CVE-2018-8020: Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. Subsequently, revoked client certificates may not be properly identified, allowing for users to authenticate with revoked certificates to connections that require mutual TLS. Users not using OCSP checks are not affected by this vulnerability.
CVE-2018-8019: When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly identified. It was therefore possible for users to authenticate with revoked certificates when using mutual TLS. Users not using OCSP checks are not affected by this vulnerability.

Please fix them.

Created: 2018-08-01 Last update: 2018-08-02 08:08

lintian reports 1 error high

Lintian reports 1 error about this package. You should make the package lintian clean getting rid of them.

Created: 2017-09-15 Last update: 2018-06-14 07:58

news

[2018-06-25] Accepted tomcat-native 1.2.17-1~bpo9+1 (source amd64) into stretch-backports (Emmanuel Bourg)
[2018-06-19] tomcat-native 1.2.17-1 MIGRATED to testing (Debian testing watch)
[2018-06-13] Accepted tomcat-native 1.2.17-1 (source) into unstable (Emmanuel Bourg)
[2018-02-23] Accepted tomcat-native 1.1.32~repack-2+deb8u1 (source amd64) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Markus Koschany)
[2018-02-23] Accepted tomcat-native 1.2.12-2+deb9u1 (source amd64) into proposed-updates->stable-new, proposed-updates (Markus Koschany)
[2018-02-11] Accepted tomcat-native 1.1.24-1+deb7u1 (source amd64) into oldoldstable (Markus Koschany)
[2018-01-24] Accepted tomcat-native 1.2.16-1~bpo9+1 (source amd64) into stretch-backports, stretch-backports (Emmanuel Bourg)
[2018-01-15] tomcat-native 1.2.16-1 MIGRATED to testing (Debian testing watch)
[2018-01-09] Accepted tomcat-native 1.2.16-1 (source) into unstable (Emmanuel Bourg)
[2017-09-19] tomcat-native 1.2.14-1 MIGRATED to testing (Debian testing watch)
[2017-09-14] Accepted tomcat-native 1.2.14-1 (source) into unstable (Emmanuel Bourg)
[2017-06-02] tomcat-native 1.2.12-2 MIGRATED to testing (Debian testing watch)
[2017-05-27] Accepted tomcat-native 1.2.12-2 (source) into unstable (Emmanuel Bourg)
[2017-05-14] Accepted tomcat-native 1.2.12-1 (source) into experimental (Emmanuel Bourg)
[2016-12-07] Accepted tomcat-native 1.2.10-1~bpo8+1 (source amd64) into jessie-backports (Emmanuel Bourg)
[2016-11-23] tomcat-native 1.2.10-1 MIGRATED to testing (Debian testing watch)
[2016-11-17] Accepted tomcat-native 1.2.10-1 (source) into unstable (Emmanuel Bourg)
[2016-07-14] Accepted tomcat-native 1.2.8-1~bpo8+1 (source amd64) into jessie-backports, jessie-backports (Emmanuel Bourg)
[2016-07-12] tomcat-native 1.2.8-1 MIGRATED to testing (Debian testing watch)
[2016-07-04] Accepted tomcat-native 1.2.8-1 (source amd64) into unstable (Emmanuel Bourg)
[2016-05-31] tomcat-native 1.2.7-1 MIGRATED to testing (Debian testing watch)
[2016-05-18] Accepted tomcat-native 1.2.7-1 (source amd64) into unstable (Emmanuel Bourg)
[2015-05-17] tomcat-native 1.1.33-1 MIGRATED to testing (Britney)
[2015-05-11] Accepted tomcat-native 1.1.33-1 (source amd64) into unstable (Emmanuel Bourg)
[2015-03-21] tomcat-native 1.1.32~repack-2 MIGRATED to testing (Britney)
[2015-03-15] Accepted tomcat-native 1.1.32~repack-2 (source amd64) into unstable (Emmanuel Bourg)
[2014-12-09] tomcat-native 1.1.32~repack-1 MIGRATED to testing (Britney)
[2014-12-03] Accepted tomcat-native 1.1.32~repack-1 (source amd64) into unstable (Emmanuel Bourg)
[2014-11-24] Accepted tomcat-native 1.1.31-1~deb6u1 (source i386) into squeeze-lts (Holger Levsen)
[2014-08-06] tomcat-native 1.1.31-1 MIGRATED to testing (Britney)

1
2

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (1, 0)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.2.17-1
2 bugs

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing