Author: kkolinko
Date: Wed Dec 16 22:42:02 2015
New Revision: 1720473
URL: http://svn.apache.org/viewvc?rev=1720473&view=rev
Log:
Add CVE-2014-7810 to changelog of released 7.0.58.
Modified:
tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml
Modified: tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml
URL:
http://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?rev=1720473&r1=1720472&r2=1720473&view=diff
==============================================================================
--- tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml (original)
+++ tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml Wed Dec 16 22:42:02 2015
@@ -1765,7 +1765,13 @@
<subsection name="Jasper">
<changelog>
<fix>
- Fix potential issue with BeanELresolver when running under a security
+ CVE-2014-7810:
+ Do not use a privileged code block when evaluating EL expressions
+ when running under a security manager, which allowed to bypass code
+ restrictions. (markt)
+ </fix>
+ <fix>
+ Fix an issue with BeanELResolver when running under a security
manager. Some classes may not be accessible but may have accessible
interfaces. (markt)
</fix>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
