- up to 7.0.90; fixes CVE-2017-12617

diff --git a/tomcat-build.xml.patch b/tomcat-build.xml.patch
index 487f13102c930df60181dda429622d85ae7e1144..52ed2442c42d37ad010391d88304c1f54e846386 100644 (file)
--- a/tomcat-build.xml.patch
+++ b/tomcat-build.xml.patch
@@ -27,7 +27,7 @@
            if="${test.cobertura}"
            description="Adds Cobertura instrumentation to the compiled bytecode">
  
-@@ -1430,52 +1369,10 @@
+@@ -1556,67 +1556,10 @@
      <mkdir dir="${tomcat.extras}/webservices"/>
    </target>
  
@@ -40,30 +40,45 @@
 -      <param name="sourcefile.2" value="${commons-logging-src.loc.2}"/>
 -      <param name="destfile" value="${commons-logging-src.tar.gz}"/>
 -      <param name="destdir" value="${commons-logging.home}"/>
+-      <param name="checksum.enabled" value="${commons-logging-src.checksum.enabled}"/>
+-      <param name="checksum.algorithm" value="${commons-logging-src.checksum.algorithm}"/>
+-      <param name="checksum.value" value="${commons-logging-src.checksum.value}"/>
 -    </antcall>
 -
 -    <antcall target="downloadfile">
 -      <param name="sourcefile" value="${avalon-framework.loc}"/>
 -      <param name="destfile" value="${avalon-framework.jar}"/>
 -      <param name="destdir" value="${avalon-framework.home}"/>
+-      <param name="checksum.enabled" value="${avalon-framework.checksum.enabled}"/>
+-      <param name="checksum.algorithm" value="${avalon-framework.checksum.algorithm}"/>
+-      <param name="checksum.value" value="${avalon-framework.checksum.value}"/>
 -    </antcall>
 -
 -    <antcall target="downloadfile">
 -      <param name="sourcefile" value="${log4j.loc}"/>
 -      <param name="destfile" value="${log4j.jar}"/>
 -      <param name="destdir" value="${log4j.home}"/>
+-      <param name="checksum.enabled" value="${log4j.checksum.enabled}"/>
+-      <param name="checksum.algorithm" value="${log4j.checksum.algorithm}"/>
+-      <param name="checksum.value" value="${log4j.checksum.value}"/>
 -    </antcall>
 -
 -    <antcall target="downloadfile">
 -      <param name="sourcefile" value="${logkit.loc}"/>
 -      <param name="destfile" value="${logkit.jar}"/>
 -      <param name="destdir" value="${logkit.home}"/>
+-      <param name="checksum.enabled" value="${logkit.checksum.enabled}"/>
+-      <param name="checksum.algorithm" value="${logkit.checksum.algorithm}"/>
+-      <param name="checksum.value" value="${logkit.checksum.value}"/>
 -    </antcall>
 -
 -    <antcall target="downloadfile">
 -      <param name="sourcefile" value="${servletapi.loc}"/>
 -      <param name="destfile" value="${servletapi.jar}"/>
 -      <param name="destdir" value="${servletapi.home}"/>
+-      <param name="checksum.enabled" value="${servletapi.checksum.enabled}"/>
+-      <param name="checksum.algorithm" value="${servletapi.checksum.algorithm}"/>
+-      <param name="checksum.value" value="${servletapi.checksum.value}"/>
 -    </antcall>
 -
 -  </target>
@@ -91,7 +106,7 @@
        <fileset file="${log4j.jar}" />
        <fileset file="${logkit.jar}" />
        <fileset file="${servletapi.jar}" />
-@@ -1577,18 +1475,6 @@
+@@ -1660,24 +1660,6 @@
            depends="extras-prepare"
            description="Prepare to build web services extras package">
  
@@ -99,12 +114,18 @@
 -      <param name="sourcefile" value="${jaxrpc-lib.loc}"/>
 -      <param name="destfile" value="${jaxrpc-lib.jar}"/>
 -      <param name="destdir" value="${jaxrpc-lib.home}"/>
+-      <param name="checksum.enabled" value="${jaxrpc-lib.checksum.enabled}"/>
+-      <param name="checksum.algorithm" value="${jaxrpc-lib.checksum.algorithm}"/>
+-      <param name="checksum.value" value="${jaxrpc-lib.checksum.value}"/>
 -    </antcall>
 -
 -    <antcall target="downloadfile">
 -      <param name="sourcefile" value="${wsdl4j-lib.loc}"/>
 -      <param name="destfile" value="${wsdl4j-lib.jar}"/>
 -      <param name="destdir" value="${wsdl4j-lib.home}"/>
+-      <param name="checksum.enabled" value="${wsdl4j-lib.checksum.enabled}"/>
+-      <param name="checksum.algorithm" value="${wsdl4j-lib.checksum.algorithm}"/>
+-      <param name="checksum.value" value="${wsdl4j-lib.checksum.value}"/>
 -    </antcall>
 -
      <copy file="${jaxrpc-lib.jar}"

diff --git a/tomcat.spec b/tomcat.spec
index 0a8f8546cec513de16b8e9f491eebcb0f6ba7d93..cb9adc65f27681d61a0027a4ff5f2d0158ece8be 100644 (file)
--- a/tomcat.spec
+++ b/tomcat.spec
@@ -9,18 +9,18 @@
 %define                tomcatnatver    1.1.27
 
 # Java Commons Logging version. Must be >= 1.1.
-%define                jclver  1.1.3
+%define                jclver  1.2
 
 %include       /usr/lib/rpm/macros.java
 Summary:       Web server and Servlet/JSP Engine, RI for Servlet %{servletapiver}/JSP %{jspapiver} API
 Summary(pl.UTF-8):     Serwer www i silnik Servlet/JSP będący wzorcową implementacją API Servlet %{servletapiver}/JSP %{jspapiver}
 Name:          tomcat
-Version:       7.0.88
+Version:       7.0.90
 Release:       1
 License:       Apache v2.0
 Group:         Networking/Daemons/Java
 Source0:       http://www.apache.org/dist/tomcat/tomcat-7/v%{version}/src/apache-%{name}-%{version}-src.tar.gz
-# Source0-md5: 839796dfd31ac436c009006f1f815b10
+# Source0-md5: d5b2197a0a5fcc2101aa54648acab2b2
 Source1:       apache-%{name}.init
 Source2:       apache-%{name}.sysconfig
 Source3:       %{name}-build.properties
@@ -32,7 +32,7 @@ Source14:     %{name}-context-examples.xml
 Source15:      %{name}.logrotate
 Source16:      log4j.properties
 Source100:     http://www.apache.org/dist/commons/logging/source/commons-logging-%{jclver}-src.tar.gz
-# Source100-md5:       e8e197d628436490886d17cffa108fe3
+# Source100-md5:       ce977548f1cbf46918e93cd38ac35163
 Patch0:                %{name}-build.xml.patch
 Patch1:                server.xml-URIEncoding-utf8.patch
 Patch2:                %{name}-LDAPUserDatabase.patch