76917 2005-01-06 09:42 0000 www-servers/tomcat: XSS issue 2005-02-06 09:11:10 0000 1 1 1 Unclassified Gentoo Security Vulnerabilities unspecified All All RESOLVED FIXED http://www.oliverkarow.de/research/jakarta556_xss.txt C4 [noglsa] P2 minor --- 1 jaervosz@gentoo.org security@gentoo.org java@gentoo.org jaervosz@gentoo.org 2005-01-06 09:42:58 0000 I'm not sure wether this affects our specific Linux versions but filing a bug to be sure. koon@gentoo.org 2005-01-07 05:37:05 0000 java team, can you confirm ? dercorny@gentoo.org 2005-01-17 06:52:16 0000 I can confirm that it works with 5.5.6-alpha1 (not in portage yet) and with the tomcat-5.0.27-r4 ebuild (latest stable in portage), after adding the "manager" role to the "tomcat" user in $CATALINA_HOME/conf/tomcat-users.xml I can't say if the patch works because I failed to apply it, though this is probably my fault. koon@gentoo.org 2005-01-17 07:33:06 0000 Thanks Stefan for verifying. Java team, please test and patch ebuild with provided patch : http://www.mail-archive.com/tomcat-dev@jakarta.apache.org/msg66978.html This is really small (XSS needing authentication) so no GLSA needed. koon@gentoo.org 2005-01-25 08:13:41 0000 It's small but should nevertheless be fixed... sejo@gentoo.org 2005-02-04 06:47:10 0000 trying to fix the bugger sejo@gentoo.org 2005-02-04 06:55:00 0000 patch fixed gentoo and committed, will be on mirrors soon. bumped to servletapi-2.4-r1 koon@gentoo.org 2005-02-04 07:36:03 0000 ppc64: please test and mark servletapi-2.4-r1 stable corsair@gentoo.org 2005-02-06 01:11:50 0000 stable on ppc64 koon@gentoo.org 2005-02-06 09:11:10 0000 Closed without GLSA