- up to 7.0.70; add patch that fixes CVE-2016-5388

[packages/tomcat.git] / tomcat-CVE-2016-5388.patch

--- apache-tomcat-7.0.70-src/java/org/apache/catalina/servlets/CGIServlet.java.orig	2016-06-15 18:45:50.000000000 +0200
+++ apache-tomcat-7.0.70-src/java/org/apache/catalina/servlets/CGIServlet.java	2016-07-19 15:35:56.656316104 +0200
@@ -1107,7 +1107,8 @@ public final class CGIServlet extends Ht
                 //REMIND: change character set
                 //REMIND: I forgot what the previous REMIND means
                 if ("AUTHORIZATION".equalsIgnoreCase(header) ||
-                    "PROXY_AUTHORIZATION".equalsIgnoreCase(header)) {
+                    "PROXY_AUTHORIZATION".equalsIgnoreCase(header) ||
+                    "PROXY".equalsIgnoreCase(header)) {
                     //NOOP per CGI specification section 11.2
                 } else {
                     envp.put("HTTP_" + header.replace('-', '_'),