Re: Max parameters limit

2024-09-11 Thread Thomas Meyer
Hi, This sounds more like a security requirement. Such constraints are usually implemented in the frontend, i.e. the http reverse proxy with mod_security or an explicit web application firewall. Any chance to implement it in a similar way in your setup? Mfg Thomas Am 11. September 2024 18:31:

Trying to Resolve a Java Version Vulnerability I'm Using for Tomcat

2024-09-11 Thread Ferrick, Michael
I downloaded JDK17. Thank you. _ Michael Ferrick MBA AVP – Application Reliability Operations | Market Data & Trader Support | GM | GA | GT | Corp (He, Him, He’s) 1 Iron Street Boston, Massachusetts, 02210 USA +1 (617) 664-5842 mds_infrastruct...@ssga.com statestreet.com

Trying to Resolve a Java Version Vulnerability I'm Using for Tomcat

2024-09-11 Thread Ferrick, Michael
Thank you! _ Michael Ferrick MBA AVP – Application Reliability Operations | Market Data & Trader Support | GM | GA | GT | Corp (He, Him, He’s) 1 Iron Street Boston, Massachusetts, 02210 USA +1 (617) 664-5842 mds_infrastruct...@ssga.com statestreet.com / State Street on L

Re: Max parameters limit

2024-09-11 Thread Tim Funk
I'd guess the "easiest" way is to use the builtin Tomcat functionality for max for the smaller number. Then for the bigger number ... Use a servlet filter for the "special" urls that slurps the "input stream" and parses the parameters in application space. And use RequestWrapper to intercept getP

Trying to Resolve a Java Version Vulnerability I'm Using for Tomcat

2024-09-11 Thread Ferrick, Michael
Thanks! I'll check into that. _ Michael Ferrick MBA AVP – Application Reliability Operations | Market Data & Trader Support | GM | GA | GT | Corp (He, Him, He’s) 1 Iron Street Boston, Massachusetts, 02210 USA +1 (617) 664-5842 mds_infrastruct...@ssga.com statestreet.com /

Re: Jersey on Tomcat 10.1

2024-09-11 Thread Jürgen Weber
interestingly, if you do not specify rs-api, jersey-container-servlet:jar:3.1.8 pulls in ws.rs-api:jar:3.1.0 [INFO] +- org.glassfish.jersey.containers:jersey-container-servlet:jar:3.1.8:compile [INFO] | +- org.glassfish.jersey.containers:jersey-container-servlet-core:jar:3.1.8:compile [INFO] |

Re: Jersey on Tomcat 10.1

2024-09-11 Thread Jürgen Weber
It works with rs-api 4.0.0 Thanks for your help! jakarta.ws.rs-api 4.0.0 Am Di., 10. Sept. 2024 um 20:27 Uhr schrieb Thomas Meyer : > > Hi, > > Looks correct, see example from GitHub: > > https://github.com/eclipse-ee4j/jersey/blob/3.1/examples/servlet3-webapp/pom.xml > > But I assume that Jerse

Re: Trying to Resolve a Java Version Vulnerability I'm Using for Tomcat

2024-09-11 Thread Christopher Schultz
Michael, On 9/11/24 09:13, Ferrick, Michael wrote: Hello, The powers above have notified me that the Java version 9.0.1.0 (x64) that I am using with Apache Tomcat 9.0.84 has a vulnerability on my Windows servers (OS 2019) and MUST be remediated. That means use another Java version! I removed

Max parameters limit

2024-09-11 Thread Christopher Schultz
All, Does anyone know if there is a way to limit the number of HTTP parameters in a POST request but explicitly allow more parameters for, say, a small set of specific URLs? Asking for a friend. -chris - To unsubscribe, e-m

Re: Trying to Resolve a Java Version Vulnerability I'm Using for Tomcat

2024-09-11 Thread Chuck Caldarale
> On Sep 11, 2024, at 08:13, Ferrick, Michael > wrote: > > The powers above have notified me that the Java version 9.0.1.0 (x64) that I > am using with Apache Tomcat 9.0.84 has a vulnerability on my Windows servers > (OS 2019) and MUST be remediated. That means use another Java version! > >

Re: Trying to Resolve a Java Version Vulnerability I'm Using for Tomcat

2024-09-11 Thread Holger Klawitter
Hi Michael, you should be fine using a contemporary version of Java like JDK17 or JDK21. Ferrick, Michael wrote (at 2024-09-11 13:13 +): > Hello, > > The powers above have notified me that the Java version 9.0.1.0 (x64) that I > am using with Apache Tomcat 9.0.84 has a vulnerability on my Wi

Re: Trying to Resolve a Java Version Vulnerability I'm Using for Tomcat

2024-09-11 Thread Mark Thomas
Michael, What is the error message when Tomcat doesn't start? We may also need to see relevant parts of all the log files in Tomcat's logs directory. Mark On 11/09/2024 14:13, Ferrick, Michael wrote: Hello, The powers above have notified me that the Java version 9.0.1.0 (x64) that I am

Trying to Resolve a Java Version Vulnerability I'm Using for Tomcat

2024-09-11 Thread Ferrick, Michael
Hello, The powers above have notified me that the Java version 9.0.1.0 (x64) that I am using with Apache Tomcat 9.0.84 has a vulnerability on my Windows servers (OS 2019) and MUST be remediated. That means use another Java version! I removed Java 9.0.1 (64-bit) and Java (tm) SE Development Kit

[ANN] Apache Tomcat 9.0.94 available

2024-09-11 Thread Rémy Maucherat
The Apache Tomcat team announces the immediate availability of Apache Tomcat 9.0.94. Apache Tomcat 9 is an open source software implementation of the Java Servlet, JavaServer Pages, Java Unified Expression Language, Java WebSocket and JASPIC technologies. Apache Tomcat 9.0.94 is a bugfix and feat