Tomcat 9 and CVE-2022-42920 (bcel vulnerability)

2022-12-06 Thread Jerry Lampi
Hi all. We use Tomcat 9.0.63 and are wondering if it's vulnerable to CVE-2022-42920? I don't see any bcel jar files, like bcel-6.0.jar, but when I scanned all jars for bcel, I found the following 22 classes with bcel in their package name in tomcat-coyote.jar: org/apache/tomcat/util/bcel/Const.

Re: Can server.xml Connector values be read from a servlet at runtime?

2015-12-17 Thread Jerry Lampi
on; not a smart card. I'm no Tomcat expert, so if there is another way to determine if clientAuth=true, that would work, too. Jerry On 12/17/2015 3:42 PM, Mark Thomas wrote: On 17/12/2015 21:32, Jerry Lampi wrote: Specifically, I need to know if the value of clientAuth in the Connector

Can server.xml Connector values be read from a servlet at runtime?

2015-12-17 Thread Jerry Lampi
Specifically, I need to know if the value of clientAuth in the Connector for port 443 is set to true. Here is my connector: So at runtime, can I read the value of clientAuth? I tried: String clientAuth = System.getProperty("clientAuth"); and String clientAuthEnv = System.getenv("clientAuth");

Re: Enabling protocol="org.apache.coyote.http11.Http11NioProtocol" causes tomcat 6.0.36 to load web page elements

2013-07-17 Thread Jerry Lampi
On 7/17/2013 2:57 PM, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jerry, On 7/17/13 3:30 PM, Jerry Lampi wrote: On 7/17/2013 2:28 PM, Christopher Schultz wrote: Jerry, On 7/17/13 3:06 PM, Jerry Lampi wrote: Good news. I previously reported that sendFile was

Re: Enabling protocol="org.apache.coyote.http11.Http11NioProtocol" causes tomcat 6.0.36 to load web page elements

2013-07-17 Thread Jerry Lampi
On 7/17/2013 2:28 PM, Christopher Schultz wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jerry, On 7/17/13 3:06 PM, Jerry Lampi wrote: Good news. I previously reported that sendFile was not enabled. As stated below by folks more knowledgeable than I, sendFile is enabled by default

Re: Enabling protocol="org.apache.coyote.http11.Http11NioProtocol" causes tomcat 6.0.36 to load web page elements

2013-07-17 Thread Jerry Lampi
PM, André Warnier wrote: Konstantin Kolinko wrote: 2013/7/13 Jerry Lampi : On Fri, Jul 12, 2013 at 4:21 PM, André Warnier wrote: Jerry Lampi wrote: On Fri, Jul 12, 2013 at 2:27 PM, Christopher Schultz < ch...@christopherschultz.net> wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256

Re: Enabling protocol="org.apache.coyote.http11.Http11NioProtocol" causes tomcat 6.0.36 to load web page elements

2013-07-12 Thread Jerry Lampi
On Fri, Jul 12, 2013 at 4:21 PM, André Warnier wrote: > Jerry Lampi wrote: > >> On Fri, Jul 12, 2013 at 2:27 PM, Christopher Schultz < >> ch...@christopherschultz.net> wrote: >> >> -BEGIN PGP SIGNED MESSAGE- >>> Hash: SHA256 >>> &g

Re: Enabling protocol="org.apache.coyote.http11.Http11NioProtocol" causes tomcat 6.0.36 to load web page elements

2013-07-12 Thread Jerry Lampi
On Fri, Jul 12, 2013 at 2:27 PM, Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Jerry, > > On 7/12/13 2:16 PM, Jerry Lampi wrote: > > When we switched from tomcat 6.0.35 to 6.0.36, the initial load

Enabling protocol="org.apache.coyote.http11.Http11NioProtocol" causes tomcat 6.0.36 to load web page elements

2013-07-12 Thread Jerry Lampi
When we switched from tomcat 6.0.35 to 6.0.36, the initial load of our sign on page became extremely slow. In 6.0.35, it would load in about 2 seconds; in 6.0.36, it loads in about 60 seconds. Our environment is an IBM mainframe running z/OS. Tomcat runs under USS (Unix System Services). The JV

Upgrading from tomcat 6.0.35 to 6.0.36 causes a simple jsp page to require about 20 minutes to load

2013-07-09 Thread Jerry Lampi
Upgrading from tomcat 6.0.35 to 6.0.36 causes a simple jsp page to require about 20 minutes to load. We have two clients that are running in an IBM mainframe USS (Unix System Services) environment and when they upgraded from tomcat 6.0.35 to 6.0.36, the simple jsp page in our webapp takes up to 20