This is an automated email from the ASF dual-hosted git repository.
jleroux pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new cdd4b361f3 Fixed: [SECURITY] Several CVEs in Apache Tomcat
(OFBIZ-13264)
cdd4b361f3 is described below
commit cdd4b361f3278c2ab4255e5e25689d93d9590010
Author: Jacques Le Roux <jacques.le.r...@les7arts.com>
AuthorDate: Thu Jun 19 12:07:14 2025 +0200
Fixed: [SECURITY] Several CVEs in Apache Tomcat (OFBIZ-13264)
https://lists.apache.org/thread/3c3q2hv3vv7bz15p4vxx9dpbqbrzpyvm
https://lists.apache.org/thread/pmtvgndbl12r0rrfnqnnxjcno0nggpbm
https://lists.apache.org/thread/p201jp4to0nr4ky9h3j97ywk2zqv185m
https://lists.apache.org/thread/gp5rzzqnp7q71bm7lsvxoow89nz1tkjw
So this is an update to Tomcat 10.1.42
---
dependencies.gradle | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/dependencies.gradle b/dependencies.gradle
index 2f8ab71a25..a9568daef5 100644
--- a/dependencies.gradle
+++ b/dependencies.gradle
@@ -62,8 +62,8 @@ dependencies {
implementation 'org.apache.tika:tika-parsers:2.9.2' // To be compatible
with tika-parser-pdf-module below
implementation 'org.apache.tika:tika-parser-pdf-module:2.9.2' // > 2.9.2
does not compile, see OFBIZ-13155
implementation 'org.apache.cxf:cxf-rt-frontend-jaxrs:3.6.4' // 4.x+
requires javax.xml.bind -> jakarta.xml.bind namespace change
- implementation 'org.apache.tomcat:tomcat-catalina-ha:10.1.39' // Remember
to change the version number (10 now) in javadoc block if needed.
- implementation 'org.apache.tomcat:tomcat-jasper:10.1.39'
+ implementation 'org.apache.tomcat:tomcat-catalina-ha:10.1.42' // Remember
to change the version number (10 now) in javadoc block if needed.
+ implementation 'org.apache.tomcat:tomcat-jasper:10.1.42'
implementation 'org.apache.axis2:axis2-kernel:1.8.2'
implementation 'org.apache.xmlgraphics:batik-anim:1.18'
implementation 'org.apache.xmlgraphics:batik-util:1.18'
