diff --git a/SOURCES/tomcat-7.0-jsvc.wrapper b/SOURCES/tomcat-7.0-jsvc.wrapper
deleted file mode 100644
index 56fcc09..0000000
--- a/SOURCES/tomcat-7.0-jsvc.wrapper
+++ /dev/null
@@ -1,83 +0,0 @@
-#!/bin/bash
-
-if [ -r /usr/share/java-utils/java-functions ]; then
- . /usr/share/java-utils/java-functions
-else
- echo "Can't read Java functions library, aborting"
- exit 1
-fi
-
-# Get the tomcat config (use this for environment specific settings)
-#if [ -z "${TOMCAT_CFG}" ]; then
-# TOMCAT_CFG="/etc/tomcat/tomcat.conf"
-#fi
-
-#if [ -r "$TOMCAT_CFG" ]; then
-# . $TOMCAT_CFG
-#fi
-
-set_javacmd
-
-# CLASSPATH munging
-if [ -n "$JSSE_HOME" ]; then
- CLASSPATH="${CLASSPATH}:$(build-classpath jcert jnet jsse 2>/dev/null)"
-fi
-CLASSPATH="${CLASSPATH}:${CATALINA_HOME}/bin/bootstrap.jar"
-CLASSPATH="${CLASSPATH}:${CATALINA_HOME}/bin/tomcat-juli.jar"
-CLASSPATH="${CLASSPATH}:$(build-classpath commons-daemon 2>/dev/null)"
-
-# if jsvc installed and USE_JSVC=true
-# then use jsvc instead of calling java directly
-if [ -x /usr/bin/jsvc ]; then
- JAVACMD="/usr/bin/jsvc -nodetach -user ${TOMCAT_USER} -outfile ${CATALINA_BASE}/logs/catalina.out -errfile ${CATALINA_BASE}/logs/catalina.out"
- if [ "$1" = "stop" ]; then
- JAVACMD="${JAVACMD} -stop"
- fi
-fi
-
-if [ "$1" = "start" ]; then
- ${JAVACMD} $JAVA_OPTS $CATALINA_OPTS \
- -classpath "$CLASSPATH" \
- -Dcatalina.base="$CATALINA_BASE" \
- -Dcatalina.home="$CATALINA_HOME" \
- -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \
- -Djava.io.tmpdir="$CATALINA_TMPDIR" \
- -Djava.util.logging.config.file="${CATALINA_BASE}/conf/logging.properties" \
- -Djava.util.logging.manager="org.apache.juli.ClassLoaderLogManager" \
- org.apache.catalina.startup.Bootstrap start \
- >> ${CATALINA_BASE}/logs/catalina.out 2>&1 &
- if [ ! -z "$CATALINA_PID" ]; then
- echo $! > $CATALINA_PID
- fi
-elif [ "$1" = "start-security" ]; then
- ${JAVACMD} $JAVA_OPTS $CATALINA_OPTS \
- -classpath "$CLASSPATH" \
- -Dcatalina.base="$CATALINA_BASE" \
- -Dcatalina.home="$CATALINA_HOME" \
- -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \
- -Djava.io.tmpdir="$CATALINA_TMPDIR" \
- -Djava.security.manager \
- -Djava.security.policy=="${CATALINA_BASE}/conf/catalina.policy" \
- -Djava.util.logging.config.file="${CATALINA_BASE}/conf/logging.properties" \
- -Djava.util.logging.manager="org.apache.juli.ClassLoaderLogManager" \
- org.apache.catalina.startup.Bootstrap start \
- >> ${CATALINA_BASE}/logs/catalina.out 2>&1 &
- if [ ! -z "$CATALINA_PID" ]; then
- echo $! > $CATALINA_PID
- fi
-elif [ "$1" = "stop" ]; then
- ${JAVACMD} $JAVA_OPTS \
- -classpath "$CLASSPATH" \
- -Dcatalina.base="$CATALINA_BASE" \
- -Dcatalina.home="$CATALINA_HOME" \
- -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \
- -Djava.io.tmpdir="$CATALINA_TMPDIR" \
- org.apache.catalina.startup.Bootstrap stop \
- >> ${CATALINA_BASE}/logs/catalina.out 2>&1
-elif [ "$1" = "version" ]; then
- ${JAVACMD} -classpath ${CATALINA_HOME}/lib/catalina.jar \
- org.apache.catalina.util.ServerInfo
-else
- echo "Usage: $0 {start|start-security|stop|version}"
- exit 1
-fi
diff --git a/SOURCES/tomcat-7.0-tomcat-jsvc-sysd b/SOURCES/tomcat-7.0-tomcat-jsvc-sysd
deleted file mode 100644
index 9134d5b..0000000
--- a/SOURCES/tomcat-7.0-tomcat-jsvc-sysd
+++ /dev/null
@@ -1,113 +0,0 @@
-#!/bin/bash
-#
-# This script provides systemd activation of the tomcat service
-# To create clones of this service:
-# 1) SERVICE_NAME must be defined before calling this script
-# 2) Create /etc/sysconfig/${SERVICE_NAME} from /etc/sysconfig/tomcat
-# to override tomcat defaults
-
-# SERVICE_NAME is a required value only if the service name is
-# different from 'tomcat'
-#
-NAME="${SERVICE_NAME:-tomcat}"
-
-#I'll bet this isn't required.
-# unset ISBOOT
-
-# For SELinux we need to use 'runuser' not 'su'
-if [ -x "/sbin/runuser" ]; then
- SU="/sbin/runuser -s /bin/sh"
-else
- SU="/bin/su -s /bin/sh"
-fi
-
-# Path to the tomcat launch script
-TOMCAT_SCRIPT="/usr/sbin/tomcat-jsvc"
-
-# Define the tomcat username
-TOMCAT_USER="${TOMCAT_USER:-tomcat}"
-
-# TOMCAT_LOG should be different from catalina.out.
-# Usually the below config is all that is necessary
-TOMCAT_LOG=/var/log/${NAME}/${NAME}-sysd.log
-
-# Get the tomcat config (use this for environment specific settings)
-TOMCAT_CFG="/etc/tomcat/tomcat.conf"
-if [ -r "$TOMCAT_CFG" ]; then
- . $TOMCAT_CFG
-fi
-
-# Get instance specific config file
-if [ -r "/etc/sysconfig/${NAME}" ]; then
- . /etc/sysconfig/${NAME}
-fi
-
-function parseOptions() {
- options=""
- options="$options $(
- awk '!/^#/ && !/^$/ { ORS=" "; print "export ", $0, ";" }' \
- $TOMCAT_CFG
- )"
- if [ -r "/etc/sysconfig/${NAME}" ]; then
- options="$options $(
- awk '!/^#/ && !/^$/ { ORS=" ";
- print "export ", $0, ";" }' \
- /etc/sysconfig/${NAME}
- )"
- fi
- TOMCAT_SCRIPT="$options ${TOMCAT_SCRIPT}"
-}
-
-# See how we were called.
-function start() {
- # fix permissions on the log and pid files
- export CATALINA_PID="/var/run/${NAME}.pid"
- touch $CATALINA_PID 2>&1
- if [ "$?" -eq "0" ]; then
- chown ${TOMCAT_USER}:${TOMCAT_USER} $CATALINA_PID
- fi
-
- touch $TOMCAT_LOG 2>&1
- if [ "$?" -eq "0" ]; then
- chown ${TOMCAT_USER}:${TOMCAT_USER} $TOMCAT_LOG
- fi
-
- # if jsvc installed and USE_JSVC=true
- # then start as root and use jsvc to drop privileges
- if [ -x /usr/bin/jsvc ]; then
- TOMCAT_USER="root"
- fi
-
- parseOptions
- if [ "$SECURITY_MANAGER" = "true" ]; then
- $SU - $TOMCAT_USER -c "${TOMCAT_SCRIPT} start-security" >> $TOMCAT_LOG 2>&1
- else
- $SU - $TOMCAT_USER -c "${TOMCAT_SCRIPT} start" >> $TOMCAT_LOG 2>&1
- fi
-}
-
-function stop() {
- # if jsvc installed and USE_JSVC=true
- # then start as root and use jsvc to drop privileges
- if [ -x /usr/bin/jsvc ]; then
- TOMCAT_USER="root"
- fi
-
- parseOptions
- $SU - $TOMCAT_USER -c "${TOMCAT_SCRIPT} stop" >> $TOMCAT_LOG 2>&1
-}
-
-# See how we were called.
-case "$1" in
- start)
- start
- ;;
- stop)
- stop
- ;;
- restart)
- stop
- start
- ;;
-esac
-
diff --git a/SOURCES/tomcat-7.0-tomcat-sysd b/SOURCES/tomcat-7.0-tomcat-sysd
deleted file mode 100644
index 192329c..0000000
--- a/SOURCES/tomcat-7.0-tomcat-sysd
+++ /dev/null
@@ -1,79 +0,0 @@
-#!/bin/bash
-#
-# This script provides systemd activation of the tomcat service
-# To create clones of this service:
-# 1) SERVICE_NAME must be defined before calling this script
-# 2) Create /etc/sysconfig/${SERVICE_NAME} from /etc/sysconfig/tomcat
-# to override tomcat defaults
-
-# SERVICE_NAME is a required value only if the service name is
-# different from 'tomcat'
-#
-export NAME="${SERVICE_NAME:-tomcat}"
-
-#I'll bet this isn't required.
-# unset ISBOOT
-
-# For SELinux we need to use 'runuser' not 'su'
-if [ -x "/sbin/runuser" ]; then
- SU="/sbin/runuser -s /bin/sh"
-else
- SU="/bin/su -s /bin/sh"
-fi
-
-# Path to the tomcat launch script
-TOMCAT_SCRIPT="/usr/sbin/tomcat"
-
-# Define the tomcat username
-TOMCAT_USER="${TOMCAT_USER:-tomcat}"
-
-# TOMCAT_LOG should be different from catalina.out.
-# Usually the below config is all that is necessary
-TOMCAT_LOG=/var/log/${NAME}/${NAME}-sysd.log
-
-# Get the tomcat config (use this for environment specific settings)
-TOMCAT_CFG="/etc/tomcat/tomcat.conf"
-if [ -r "$TOMCAT_CFG" ]; then
- . $TOMCAT_CFG
-fi
-
-# Get instance specific config file
-if [ -r "/etc/sysconfig/${NAME}" ]; then
- . /etc/sysconfig/${NAME}
-fi
-
-# See how we were called.
-function start() {
- # fix permissions on the log and pid files
- export CATALINA_PID="/var/run/${NAME}.pid"
-
- touch $TOMCAT_LOG 2>&1
- if [ "$?" -eq "0" ]; then
- chown ${TOMCAT_USER}:${TOMCAT_USER} $TOMCAT_LOG
- fi
-
- if [ "$SECURITY_MANAGER" = "true" ]; then
- ${TOMCAT_SCRIPT} start-security >> $TOMCAT_LOG 2>&1
- else
- ${TOMCAT_SCRIPT} start #>> $TOMCAT_LOG 2>&1
- fi
-}
-
-function stop() {
- ${TOMCAT_SCRIPT} stop >> $TOMCAT_LOG 2>&1
-}
-
-# See how we were called.
-case "$1" in
- start)
- start
- ;;
- stop)
- stop
- ;;
- restart)
- stop
- start
- ;;
-esac
-
diff --git a/SOURCES/tomcat-7.0.54-CVE-2014-0227.patch b/SOURCES/tomcat-7.0.54-CVE-2014-0227.patch
old mode 100644
new mode 100755
diff --git a/SOURCES/tomcat-7.0.54-CVE-2014-7810.patch b/SOURCES/tomcat-7.0.54-CVE-2014-7810.patch
new file mode 100644
index 0000000..32ca660
--- /dev/null
+++ b/SOURCES/tomcat-7.0.54-CVE-2014-7810.patch
@@ -0,0 +1,120 @@
+--- java/javax/el/BeanELResolver.java.orig 2016-06-02 09:46:15.019196027 -0400
++++ java/javax/el/BeanELResolver.java 2016-06-02 09:46:15.025196055 -0400
+@@ -251,15 +251,39 @@
+ try {
+ BeanInfo info = Introspector.getBeanInfo(this.type);
+ PropertyDescriptor[] pds = info.getPropertyDescriptors();
+- for (int i = 0; i < pds.length; i++) {
+- this.properties.put(pds[i].getName(), new BeanProperty(
+- type, pds[i]));
++ for (PropertyDescriptor pd: pds) {
++ this.properties.put(pd.getName(), new BeanProperty(type, pd));
++ }
++ if (System.getSecurityManager() != null) {
++ // When running with SecurityManager, some classes may be
++ // not accessible, but have accessible interfaces.
++ populateFromInterfaces(type);
+ }
+ } catch (IntrospectionException ie) {
+ throw new ELException(ie);
+ }
+ }
+
++ private void populateFromInterfaces(Class<?> aClass) throws IntrospectionException {
++ Class<?> interfaces[] = aClass.getInterfaces();
++ if (interfaces.length > 0) {
++ for (Class<?> ifs : interfaces) {
++ BeanInfo info = Introspector.getBeanInfo(ifs);
++ PropertyDescriptor[] pds = info.getPropertyDescriptors();
++ for (PropertyDescriptor pd : pds) {
++ if (!this.properties.containsKey(pd.getName())) {
++ this.properties.put(pd.getName(), new BeanProperty(
++ this.type, pd));
++ }
++ }
++ }
++ }
++ Class<?> superclass = aClass.getSuperclass();
++ if (superclass != null) {
++ populateFromInterfaces(superclass);
++ }
++ }
++
+ private BeanProperty get(ELContext ctx, String name) {
+ BeanProperty property = this.properties.get(name);
+ if (property == null) {
+--- java/org/apache/jasper/runtime/PageContextImpl.java.orig 2016-06-02 09:46:15.020196032 -0400
++++ java/org/apache/jasper/runtime/PageContextImpl.java 2016-06-02 09:46:15.026196060 -0400
+@@ -937,37 +937,11 @@
+ final Class<?> expectedType, final PageContext pageContext,
+ final ProtectedFunctionMapper functionMap, final boolean escape)
+ throws ELException {
+- Object retValue;
+ final ExpressionFactory exprFactory = jspf.getJspApplicationContext(pageContext.getServletContext()).getExpressionFactory();
+- if (SecurityUtil.isPackageProtectionEnabled()) {
+- try {
+- retValue = AccessController
+- .doPrivileged(new PrivilegedExceptionAction<Object>() {
+-
+- @Override
+- public Object run() throws Exception {
+- ELContextImpl ctx = (ELContextImpl) pageContext.getELContext();
+- ctx.setFunctionMapper(new FunctionMapperImpl(functionMap));
+- ValueExpression ve = exprFactory.createValueExpression(ctx, expression, expectedType);
+- return ve.getValue(ctx);
+- }
+- });
+- } catch (PrivilegedActionException ex) {
+- Exception realEx = ex.getException();
+- if (realEx instanceof ELException) {
+- throw (ELException) realEx;
+- } else {
+- throw new ELException(realEx);
+- }
+- }
+- } else {
+- ELContextImpl ctx = (ELContextImpl) pageContext.getELContext();
+- ctx.setFunctionMapper(new FunctionMapperImpl(functionMap));
+- ValueExpression ve = exprFactory.createValueExpression(ctx, expression, expectedType);
+- retValue = ve.getValue(ctx);
+- }
+-
+- return retValue;
++ ELContextImpl ctx = (ELContextImpl) pageContext.getELContext();
++ ctx.setFunctionMapper(new FunctionMapperImpl(functionMap));
++ ValueExpression ve = exprFactory.createValueExpression(ctx, expression, expectedType);
++ return ve.getValue(ctx);
+ }
+
+ @Override
+--- java/org/apache/jasper/security/SecurityClassLoad.java.orig 2016-06-02 09:46:15.020196032 -0400
++++ java/org/apache/jasper/security/SecurityClassLoad.java 2016-06-02 09:46:15.027196065 -0400
+@@ -93,8 +93,6 @@
+ "runtime.PageContextImpl$11");
+ loader.loadClass( basePackage +
+ "runtime.PageContextImpl$12");
+- loader.loadClass( basePackage +
+- "runtime.PageContextImpl$13");
+
+ loader.loadClass( basePackage +
+ "runtime.JspContextWrapper");
+--- webapps/docs/changelog.xml.orig 2016-06-02 09:46:15.022196041 -0400
++++ webapps/docs/changelog.xml 2016-06-02 09:48:48.443915711 -0400
+@@ -55,6 +55,17 @@
+ They eventually become mixed with the numbered issues. (I.e., numbered
+ issues to not "pop up" wrt. others).
+ -->
++<section name="Tomcat 7.0.54-3 (csutherl)">
++ <subsection name="Jasper">
++ <changelog>
++ <fix>
++ Fix potential issue with BeanELresolver when running under a security
++ manager. Some classes may not be accessible but may have accessible
++ interfaces. (markt)
++ </fix>
++ </changelog>
++ </subsection>
++</section>
+ <section name="Tomcat 7.0.54 (violetagg)">
+ <subsection name="Catalina">
+ <changelog>
diff --git a/SOURCES/tomcat-7.0.54-CVE-2015-5346.patch b/SOURCES/tomcat-7.0.54-CVE-2015-5346.patch
new file mode 100644
index 0000000..48c38b7
--- /dev/null
+++ b/SOURCES/tomcat-7.0.54-CVE-2015-5346.patch
@@ -0,0 +1,84 @@
+--- java/org/apache/catalina/connector/CoyoteAdapter.java.orig 2016-07-06 14:53:28.217385543 -0400
++++ java/org/apache/catalina/connector/CoyoteAdapter.java 2016-07-06 15:02:49.045710268 -0400
+@@ -750,6 +750,10 @@
+ version = ctxt.getWebappVersion();
+ // Reset mapping
+ request.getMappingData().recycle();
++ mapRequired = true;
++ // Recycle session info in case the correct
++ // context is configured with different settings
++ request.recycleSessionInfo();
+ break;
+ }
+ }
+--- java/org/apache/catalina/connector/Request.java.orig 2016-07-06 14:53:28.218385547 -0400
++++ java/org/apache/catalina/connector/Request.java 2016-07-06 14:53:28.222385563 -0400
+@@ -494,18 +494,7 @@
+ notes.clear();
+ cookies = null;
+
+- if (session != null) {
+- try {
+- session.endAccess();
+- } catch (Throwable t) {
+- ExceptionUtils.handleThrowable(t);
+- log.warn(sm.getString("coyoteRequest.sessionEndAccessFail"), t);
+- }
+- }
+- session = null;
+- requestedSessionCookie = false;
+- requestedSessionId = null;
+- requestedSessionURL = false;
++ recycleSessionInfo();
+
+ if (Globals.IS_SECURITY_ENABLED || Connector.RECYCLE_FACADES) {
+ parameterMap = new ParameterMap<String, String[]>();
+@@ -553,11 +542,24 @@
+ }
+
+
+- /**
+- * Clear cached encoders (to save memory for Comet requests).
+- */
+- public boolean read()
+- throws IOException {
++ protected void recycleSessionInfo() {
++ if (session != null) {
++ try {
++ session.endAccess();
++ } catch (Throwable t) {
++ ExceptionUtils.handleThrowable(t);
++ log.warn(sm.getString("coyoteRequest.sessionEndAccessFail"), t);
++ }
++ }
++ session = null;
++ requestedSessionCookie = false;
++ requestedSessionId = null;
++ requestedSessionURL = false;
++ requestedSessionSSL = false;
++ }
++
++
++ public boolean read() throws IOException {
+ return (inputBuffer.realReadBytes(null, 0, 0) > 0);
+ }
+
+--- webapps/docs/changelog.xml.orig 2016-07-06 14:53:28.219385551 -0400
++++ webapps/docs/changelog.xml 2016-07-06 15:04:26.761927698 -0400
+@@ -55,6 +55,16 @@
+ They eventually become mixed with the numbered issues. (I.e., numbered
+ issues to not "pop up" wrt. others).
+ -->
++<section name="Tomcat 7.0.54-4 (csutherl)">
++ <subsection name="Catalina">
++ <changelog>
++ <fix>
++ Handle the unlikely case where different versions of a web application
++ are deployed with different session settings. (markt)
++ </fix>
++ </changelog>
++ </subsection>
++</section>
+ <section name="Tomcat 7.0.54-3 (csutherl)">
+ <subsection name="Jasper">
+ <changelog>
diff --git a/SOURCES/tomcat-7.0.54-CVE-2016-5388.patch b/SOURCES/tomcat-7.0.54-CVE-2016-5388.patch
new file mode 100644
index 0000000..f420b57
--- /dev/null
+++ b/SOURCES/tomcat-7.0.54-CVE-2016-5388.patch
@@ -0,0 +1,117 @@
+--- conf/web.xml.orig 2016-08-23 14:53:40.388143818 -0400
++++ conf/web.xml 2016-08-23 14:53:40.393143812 -0400
+@@ -325,6 +325,15 @@
+ <!-- executable Name of the executable used to run the -->
+ <!-- script. [perl] -->
+ <!-- -->
++ <!-- envHttpHeaders A regular expression used to select the HTTP -->
++ <!-- headers passed to the CGI process as -->
++ <!-- environment variables. Note that headers are -->
++ <!-- converted to upper case before matching and -->
++ <!-- that the entire header name must match the -->
++ <!-- pattern. -->
++ <!-- [ACCEPT[-0-9A-Z]*|CACHE-CONTROL|COOKIE|HOST| -->
++ <!-- IF-[-0-9A-Z]*|REFERER|USER-AGENT] -->
++ <!-- -->
+ <!-- parameterEncoding Name of parameter encoding to be used with -->
+ <!-- CGI servlet. -->
+ <!-- [System.getProperty("file.encoding","UTF-8")] -->
+@@ -348,7 +357,7 @@
+ <param-name>cgiPathPrefix</param-name>
+ <param-value>WEB-INF/cgi</param-value>
+ </init-param>
+- <load-on-startup>5</load-on-startup>
++ <load-on-startup>5</load-on-startup>
+ </servlet>
+ -->
+
+--- java/org/apache/catalina/servlets/CGIServlet.java.orig 2016-08-23 14:53:40.388143818 -0400
++++ java/org/apache/catalina/servlets/CGIServlet.java 2016-08-23 14:55:47.393989981 -0400
+@@ -36,6 +36,7 @@
+ import java.util.Locale;
+ import java.util.StringTokenizer;
+ import java.util.Vector;
++import java.util.regex.Pattern;
+
+ import javax.servlet.RequestDispatcher;
+ import javax.servlet.ServletConfig;
+@@ -268,6 +269,16 @@
+ */
+ private long stderrTimeout = 2000;
+
++ /**
++ * The regular expression used to select HTTP headers to be passed to the
++ * CGI process as environment variables. The name of the environment
++ * variable will be the name of the HTTP header converter to upper case,
++ * prefixed with <code>HTTP_</code> and with all <code>-</code> characters
++ * converted to <code>_</code>.
++ */
++ private Pattern envHttpHeadersPattern = Pattern.compile(
++ "ACCEPT[-0-9A-Z]*|CACHE-CONTROL|COOKIE|HOST|IF-[-0-9A-Z]*|REFERER|USER-AGENT");
++
+ /** object used to ensure multiple threads don't try to expand same file */
+ static Object expandFileLock = new Object();
+
+@@ -331,6 +342,10 @@
+ "stderrTimeout"));
+ }
+
++ if (getServletConfig().getInitParameter("envHttpHeaders") != null) {
++ envHttpHeadersPattern =
++ Pattern.compile(getServletConfig().getInitParameter("envHttpHeaders"));
++ }
+ }
+
+
+@@ -1072,12 +1087,8 @@
+ //REMIND: rewrite multiple headers as if received as single
+ //REMIND: change character set
+ //REMIND: I forgot what the previous REMIND means
+- if ("AUTHORIZATION".equalsIgnoreCase(header) ||
+- "PROXY_AUTHORIZATION".equalsIgnoreCase(header)) {
+- //NOOP per CGI specification section 11.2
+- } else {
+- envp.put("HTTP_" + header.replace('-', '_'),
+- req.getHeader(header));
++ if (envHttpHeadersPattern.matcher(header).matches()) {
++ envp.put("HTTP_" + header.replace('-', '_'), req.getHeader(header));
+ }
+ }
+
+--- webapps/docs/cgi-howto.xml.orig 2016-08-23 14:53:40.389143817 -0400
++++ webapps/docs/cgi-howto.xml 2016-08-23 14:57:37.634856451 -0400
+@@ -86,6 +86,12 @@
+ <li><strong>executable-arg-1</strong>, <strong>executable-arg-2</strong>,
+ and so on - additional arguments for the executable. These precede the
+ CGI script name. By default there are no additional arguments.</li>
++<li><strong>envHttpHeaders</strong> - A regular expression used to select the
++HTTP headers passed to the CGI process as environment variables. Note that
++headers are converted to upper case before matching and that the entire header
++name must match the pattern. Default is
++<code>ACCEPT[-0-9A-Z]*|CACHE-CONTROL|COOKIE|HOST|IF-[-0-9A-Z]*|REFERER|USER-AGENT</code>
++</li>
+ <li><strong>parameterEncoding</strong> - Name of the parameter encoding
+ to be used with the CGI servlet. Default is
+ <code>System.getProperty("file.encoding","UTF-8")</code>.</li>
+--- webapps/docs/changelog.xml.orig 2016-08-23 14:53:40.390143815 -0400
++++ webapps/docs/changelog.xml 2016-08-23 14:57:09.959889972 -0400
+@@ -55,6 +55,19 @@
+ They eventually become mixed with the numbered issues. (I.e., numbered
+ issues to not "pop up" wrt. others).
+ -->
++<section name="Tomcat 7.0.54-7 (csutherl)">
++ <subsection name="Catalina">
++ <changelog>
++ <add>
++ Add a new initialisation parameter, <code>envHttpHeaders</code>, to
++ the CGI Servlet to mitigate <a href="https://httpoxy.org">httpoxy</a>
++ (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5388"
++ >CVE-2016-5388</a>) by default and to provide a mechanism that can be
++ used to mitigate any future, similar issues. (markt)
++ </add>
++ </changelog>
++ </subsection>
++</section>
+ <section name="Tomcat 7.0.54-4 (csutherl)">
+ <subsection name="Catalina">
+ <changelog>
diff --git a/SOURCES/tomcat-7.0.sysconfig b/SOURCES/tomcat-7.0.sysconfig
index c1337e8..4d2c297 100644
--- a/SOURCES/tomcat-7.0.sysconfig
+++ b/SOURCES/tomcat-7.0.sysconfig
@@ -44,9 +44,6 @@
# Whether to annoy the user with "attempting to shut down" messages or not
#SHUTDOWN_VERBOSE="false"
-# Set the TOMCAT_PID location
-#CATALINA_PID="/var/run/tomcat.pid"
-
# Connector port is 8080 for this tomcat instance
#CONNECTOR_PORT="8080"
diff --git a/SOURCES/tomcat-7.0.wrapper b/SOURCES/tomcat-7.0.wrapper
index 8d35a2f..c97cb85 100644
--- a/SOURCES/tomcat-7.0.wrapper
+++ b/SOURCES/tomcat-7.0.wrapper
@@ -1,83 +1,24 @@
#!/bin/bash
-if [ -r /usr/share/java-utils/java-functions ]; then
- . /usr/share/java-utils/java-functions
-else
- echo "Can't read Java functions library, aborting"
- exit 1
-fi
-
-# Get the tomcat config (use this for environment specific settings)
-if [ -z "${TOMCAT_CFG}" ]; then
- TOMCAT_CFG="/etc/tomcat/tomcat.conf"
-fi
-
-if [ -r "$TOMCAT_CFG" ]; then
- . $TOMCAT_CFG
-fi
-
-# Get instance specific config file
-if [ -r "/etc/sysconfig/${NAME}" ]; then
- . /etc/sysconfig/${NAME}
-fi
-
-set_javacmd
-cd ${CATALINA_HOME}
-# CLASSPATH munging
-if [ ! -z "$CLASSPATH" ] ; then
- CLASSPATH="$CLASSPATH":
+if [ "$1" = "version" ]; then
+ . /usr/libexec/tomcat/preamble
+ exec ${JAVACMD} -classpath ${CATALINA_HOME}/lib/catalina.jar \
+ org.apache.catalina.util.ServerInfo
fi
-if [ -n "$JSSE_HOME" ]; then
- CLASSPATH="${CLASSPATH}$(build-classpath jcert jnet jsse 2>/dev/null):"
+SRV="tomcat"
+if [ -n "$2" ]; then
+ SRV="tomcat@$2"
fi
-CLASSPATH="${CLASSPATH}${CATALINA_HOME}/bin/bootstrap.jar"
-CLASSPATH="${CLASSPATH}:${CATALINA_HOME}/bin/tomcat-juli.jar"
-CLASSPATH="${CLASSPATH}:$(build-classpath commons-daemon 2>/dev/null)"
if [ "$1" = "start" ]; then
- ${JAVACMD} $JAVA_OPTS $CATALINA_OPTS \
- -classpath "$CLASSPATH" \
- -Dcatalina.base="$CATALINA_BASE" \
- -Dcatalina.home="$CATALINA_HOME" \
- -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \
- -Djava.io.tmpdir="$CATALINA_TMPDIR" \
- -Djava.util.logging.config.file="${CATALINA_BASE}/conf/logging.properties" \
- -Djava.util.logging.manager="org.apache.juli.ClassLoaderLogManager" \
- org.apache.catalina.startup.Bootstrap start \
- >> ${CATALINA_BASE}/logs/catalina.out 2>&1 &
- if [ ! -z "$CATALINA_PID" ]; then
- echo $! > $CATALINA_PID
- fi
-elif [ "$1" = "start-security" ]; then
- ${JAVACMD} $JAVA_OPTS $CATALINA_OPTS \
- -classpath "$CLASSPATH" \
- -Dcatalina.base="$CATALINA_BASE" \
- -Dcatalina.home="$CATALINA_HOME" \
- -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \
- -Djava.io.tmpdir="$CATALINA_TMPDIR" \
- -Djava.security.manager \
- -Djava.security.policy=="${CATALINA_BASE}/conf/catalina.policy" \
- -Djava.util.logging.config.file="${CATALINA_BASE}/conf/logging.properties" \
- -Djava.util.logging.manager="org.apache.juli.ClassLoaderLogManager" \
- org.apache.catalina.startup.Bootstrap start \
- >> ${CATALINA_BASE}/logs/catalina.out 2>&1 &
- if [ ! -z "$CATALINA_PID" ]; then
- echo $! > $CATALINA_PID
- fi
+ systemctl start ${SRV}.service
elif [ "$1" = "stop" ]; then
- ${JAVACMD} $JAVA_OPTS \
- -classpath "$CLASSPATH" \
- -Dcatalina.base="$CATALINA_BASE" \
- -Dcatalina.home="$CATALINA_HOME" \
- -Djava.endorsed.dirs="$JAVA_ENDORSED_DIRS" \
- -Djava.io.tmpdir="$CATALINA_TMPDIR" \
- org.apache.catalina.startup.Bootstrap stop \
- >> ${CATALINA_BASE}/logs/catalina.out 2>&1
+ systemctl stop ${SRV}.service
elif [ "$1" = "version" ]; then
${JAVACMD} -classpath ${CATALINA_HOME}/lib/catalina.jar \
org.apache.catalina.util.ServerInfo
else
- echo "Usage: $0 {start|start-security|stop|version}"
+ echo "Usage: $0 {start|stop|version} [server-id]"
exit 1
fi
diff --git a/SPECS/tomcat.spec b/SPECS/tomcat.spec
index 71eaf13..d8816a4 100644
--- a/SPECS/tomcat.spec
+++ b/SPECS/tomcat.spec
@@ -54,7 +54,7 @@
Name: tomcat
Epoch: 0
Version: %{major_version}.%{minor_version}.%{micro_version}
-Release: 2%{?dist}
+Release: 8%{?dist}
Summary: Apache Servlet/JSP Engine, RI for Servlet %{servletspec}/JSP %{jspspec} API
Group: System Environment/Daemons
@@ -62,7 +62,6 @@ License: ASL 2.0
URL: http://tomcat.apache.org/
Source0: http://www.apache.org/dist/tomcat/tomcat-%{major_version}/v%{version}/src/%{packdname}.tar.gz
Source1: %{name}-%{major_version}.%{minor_version}.conf
-#Source2: %{name}-%{major_version}.%{minor_version}.init
Source3: %{name}-%{major_version}.%{minor_version}.sysconfig
Source4: %{name}-%{major_version}.%{minor_version}.wrapper
Source5: %{name}-%{major_version}.%{minor_version}.logrotate
@@ -77,9 +76,6 @@ Source13: jasper-el-OSGi-MANIFEST.MF
Source14: jasper-OSGi-MANIFEST.MF
Source15: tomcat-api-OSGi-MANIFEST.MF
Source16: tomcat-juli-OSGi-MANIFEST.MF
-Source17: %{name}-%{major_version}.%{minor_version}-tomcat-sysd
-Source18: %{name}-%{major_version}.%{minor_version}-tomcat-jsvc-sysd
-Source19: %{name}-%{major_version}.%{minor_version}-jsvc.wrapper
Source20: %{name}-%{major_version}.%{minor_version}-jsvc.service
Source21: tomcat-functions
Source22: tomcat-preamble
@@ -91,15 +87,9 @@ Patch0: %{name}-%{major_version}.%{minor_version}-bootstrap-MANIFEST.MF.patch
Patch1: %{name}-%{major_version}.%{minor_version}-tomcat-users-webapp.patch
Patch2: tomcat-7.0.54-rebase.patch
Patch3: %{name}-7.0.54-CVE-2014-0227.patch
-#Patch2: %{name}-%{version}-CVE-2013-4286.patch
-#Patch3: %{name}-%{version}-CVE-2013-4322.patch
-#Patch4: %{name}-%{version}-CVE-2014-0050.patch
-#Patch5: %{name}-%{version}-CVE-2014-0099.patch
-#Patch6: %{name}-%{version}-CVE-2014-0096.patch
-#Patch7: %{name}-%{version}-CVE-2014-0075.patch
-
-# Postponed
-#Patch5: %{name}-%{version}-CVE-2013-4590.patch
+Patch4: %{name}-7.0.54-CVE-2014-7810.patch
+Patch5: %{name}-7.0.54-CVE-2015-5346.patch
+Patch6: %{name}-7.0.54-CVE-2016-5388.patch
BuildArch: noarch
@@ -248,6 +238,9 @@ find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name "
%patch1 -p0
%patch2 -p0
%patch3 -p0
+%patch4 -p0
+%patch5 -p0
+%patch6 -p0
%{__ln_s} $(build-classpath jakarta-taglibs-core) webapps/examples/WEB-INF/lib/jstl.jar
%{__ln_s} $(build-classpath jakarta-taglibs-standard) webapps/examples/WEB-INF/lib/standard.jar
@@ -339,9 +332,7 @@ zip -u output/build/bin/tomcat-juli.jar META-INF/MANIFEST.MF
%{__install} -d -m 0755 ${RPM_BUILD_ROOT}%{libdir}
%{__install} -d -m 0775 ${RPM_BUILD_ROOT}%{logdir}
/bin/touch ${RPM_BUILD_ROOT}%{logdir}/catalina.out
-%{__install} -d -m 0775 ${RPM_BUILD_ROOT}%{_localstatedir}/run
%{__install} -d -m 0775 ${RPM_BUILD_ROOT}%{_localstatedir}/lib/tomcats
-/bin/touch ${RPM_BUILD_ROOT}%{_localstatedir}/run/%{name}.pid
/bin/echo "%{name}-%{major_version}.%{minor_version}.%{micro_version} RPM installed" >> ${RPM_BUILD_ROOT}%{logdir}/catalina.out
%{__install} -d -m 0775 ${RPM_BUILD_ROOT}%{homedir}
%{__install} -d -m 0775 ${RPM_BUILD_ROOT}%{tempdir}
@@ -506,11 +497,6 @@ done
# replace temporary copy with link
%{__ln_s} -f %{bindir}/tomcat-juli.jar ${RPM_BUILD_ROOT}%{libdir}/
-mkdir -p ${RPM_BUILD_ROOT}%{_prefix}/lib/tmpfiles.d
-cat > ${RPM_BUILD_ROOT}%{_prefix}/lib/tmpfiles.d/%{name}.conf <<EOF
-f %{_localstatedir}/run/%{name}.pid 0644 tomcat tomcat -
-EOF
-
%pre
# add the tomcat user and group
@@ -580,30 +566,31 @@ fi
%attr(0755,root,root) %{_libexecdir}/%{name}/preamble
%attr(0755,root,root) %{_libexecdir}/%{name}/server
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
-%config(noreplace) %{_sysconfdir}/sysconfig/%{name}
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysconfig/%{name}
%attr(0755,root,tomcat) %dir %{basedir}
%attr(0755,root,tomcat) %dir %{confdir}
+
%defattr(0664,tomcat,root,0770)
%attr(0770,tomcat,root) %dir %{logdir}
+
%defattr(0664,root,tomcat,0770)
%attr(0660,tomcat,tomcat) %{logdir}/catalina.out
-%attr(0644,tomcat,tomcat) %{_localstatedir}/run/%{name}.pid
%attr(0770,root,tomcat) %dir %{cachedir}
%attr(0770,root,tomcat) %dir %{tempdir}
%attr(0770,root,tomcat) %dir %{workdir}
-%defattr(0664,root,tomcat,0775)
+
+%defattr(0644,root,tomcat,0775)
%attr(0775,root,tomcat) %dir %{appdir}
%attr(0775,root,tomcat) %dir %{confdir}/Catalina
%attr(0775,root,tomcat) %dir %{confdir}/Catalina/localhost
-%attr(0664,tomcat,tomcat) %config(noreplace) %{confdir}/%{name}.conf
-%attr(0664,tomcat,tomcat) %config(noreplace) %{confdir}/*.policy
-%attr(0664,tomcat,tomcat) %config(noreplace) %{confdir}/*.properties
-%attr(0664,tomcat,tomcat) %config(noreplace) %{confdir}/context.xml
-%attr(0664,tomcat,tomcat) %config(noreplace) %{confdir}/server.xml
-%attr(0660,tomcat,tomcat) %config(noreplace) %{confdir}/tomcat-users.xml
-%attr(0664,tomcat,tomcat) %config(noreplace) %{confdir}/web.xml
+%config(noreplace) %{confdir}/%{name}.conf
+%config(noreplace) %{confdir}/*.policy
+%config(noreplace) %{confdir}/*.properties
+%config(noreplace) %{confdir}/context.xml
+%config(noreplace) %{confdir}/server.xml
+%attr(0640,root,tomcat) %config(noreplace) %{confdir}/tomcat-users.xml
+%config(noreplace) %{confdir}/web.xml
%dir %{homedir}
-%{_prefix}/lib/tmpfiles.d/%{name}.conf
%{bindir}/bootstrap.jar
%{bindir}/catalina-tasks.xml
%{homedir}/lib
@@ -680,8 +667,24 @@ fi
%attr(0644,root,root) %{_unitdir}/%{name}-jsvc.service
%changelog
+* Thu Aug 25 2016 Coty Sutherland <csutherl@redhat.com> - 0:7.0.54-8
+- Resolves: rhbz#1368121
+
+* Tue Aug 23 2016 Coty Sutherland <csutherl@redhat.com> - 0:7.0.54-7
+- Resolves: rhbz#1362212 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
+- Resolves: rhbz#1368121
+
+* Wed Aug 03 2016 Coty Sutherland <csutherl@redhat.com> - 0:7.0.54-5
+- Resolves: rhbz#1362567
+
+* Wed Jul 06 2016 Coty Sutherland <csutherl@redhat.com> 0:7.0.54-4
+- Resolves: CVE-2015-5346
+
+* Thu Jun 02 2016 Coty Sutherland <csutherl@redhat.com> 0:7.0.54-3
+- Resolves: CVE-2014-7810
+
* Tue Mar 24 2015 David Knox <dknox@redhat.com> - 0:7.0.54-2
-- Resovles: CVE-2014-0227
+- Resolves: CVE-2014-0227
* Wed Sep 17 2014 David Knox <dknox@redhat.com> - 0:7.0.54-1
- Resolves: rhbz#1141372 - Remove systemv artifacts. Add new systemd