Re: SUSPICIOUS Re: Updating configTest to include shutdown port validation

2025-06-23 Thread Amit Pande
Thank you Chris for the inputs. export JAVA_OPTS=-Dorg.apache.catalina.startup.EXIT_ON_INIT_FAILURE=true before running the configtest This seems to help fail the validation if connector initialization fails. Thanks, Amit From: Christopher Schultz Sent: Sunday,

Re: Need confirmation about CVE-2025-48988 impacting Tomcat 9.0.10x related to CVE-2025-48976.

2025-06-23 Thread Rémy Maucherat
Hi, On Mon, Jun 23, 2025 at 12:12 PM Charpe, Anil wrote: > > Hi, > It is about the CVE-2025-48988 mentioned in the email subject. > I have a question that- if we update the "Apache Commons FileUpload" jar to > the version which fixes the CVE-2025-48976; in that case, do we still need to > updat

Need confirmation about CVE-2025-48988 impacting Tomcat 9.0.10x related to CVE-2025-48976.

2025-06-23 Thread Charpe, Anil
Hi, It is about the CVE-2025-48988 mentioned in the email subject. I have a question that- if we update the "Apache Commons FileUpload" jar to the version which fixes the CVE-2025-48976; in that case, do we still need to update the Apache Tomcat to 9.0.106, 10.1.42 & 11.0.8 which has CVE-2025

Need confirmation about CVE-2025-48988 impacting Tomcat 9.0.10x related to CVE-2025-48976.

2025-06-23 Thread Charpe, Anil
Hi, It is about the CVE-2025-48988 mentioned in the email subject. I have a question that- if we update the "Apache Commons FileUpload" jar to the version which fixes the CVE-2025-48976; in that case, do we still need to update the Apache Tomcat to 9.0.106, 10.1.42 & 11.0.8 which has CVE-2025

Re: CSRF not working with 10.1.42 but it works with 10.1.39

2025-06-23 Thread Mark Thomas
On 23/06/2025 01:17, Hrvoje Lončar wrote: If someone else has a problem with latest "security fix", here is a working solution to run your Spring Boot app directly from Eclipse STS without installing a Tomcat and deploying to it. Now you can submit forms the same way as you did before. You can fi