Re: [tomcat] branch main updated: Invalid byte sequences result in a 400 response.

2021-10-14 Thread Christopher Schultz
Mark, On 10/14/21 05:42, Mark Thomas wrote: On 14/10/2021 10:34, ma...@apache.org wrote: This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to

Re: [tomcat] branch main updated: Do not add a trailing / to a request URI during canonicalization.

2021-10-14 Thread Christopher Schultz
Mark, Konstantin, On 10/14/21 05:40, Mark Thomas wrote: On 14/10/2021 10:25, Konstantin Kolinko wrote: чт, 14 окт. 2021 г. в 11:25, Mark Thomas : On 14/10/2021 09:22, ma...@apache.org wrote: This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch

Re: [tomcat] branch main updated: Do not add a trailing / to a request URI during canonicalization.

2021-10-14 Thread Mark Thomas
On 14/10/2021 12:37, Rémy Maucherat wrote: On Thu, Oct 14, 2021 at 11:40 AM Mark Thomas wrote: On 14/10/2021 10:25, Konstantin Kolinko wrote: d. If backporting, it would better be configurable. Yeah, I know. I'd like to avoid lots of new configuration options. Maybe a single new option

[SECURITY] CVE-2021-42340 Apache Tomcat DoS

2021-10-14 Thread Mark Thomas
CVE-2021-42340 Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 10.1.0-M1 to 10.1.0-M5 Apache Tomcat 10.0.0-M10 to 10.0.11 Apache Tomcat 9.0.40 to 9.0.53 Apache Tomcat 8.5.60 to 8.5.71 Description: The fix for bug 63362 introduced a

[SECURITY] CVE-2021-42340 Apache Tomcat DoS

2021-10-14 Thread Mark Thomas
CVE-2021-41079 Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 10.1.0-M1 to 10.1.0-M5 Apache Tomcat 10.0.0-M10 to 10.0.11 Apache Tomcat 9.0.40 to 9.0.53 Apache Tomcat 8.5.60 to 8.5.71 Description: The fix for bug 63362 introduced a

svn commit: r1894251 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml

2021-10-14 Thread markt
Author: markt Date: Thu Oct 14 14:12:15 2021 New Revision: 1894251 URL: http://svn.apache.org/viewvc?rev=1894251&view=rev Log: Add CVE-2021-42340 Modified: tomcat/site/trunk/docs/security-10.html tomcat/site/trunk/docs/security-8.html tomcat/site/trunk/docs/security-9.html tomcat/

[tomcat] 02/02: Add tests cases for URI canonicalization from the Servlet spec

2021-10-14 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git commit fee1f457f287a56d3d490a5ab5b3f643d280ecf5 Author: Mark Thomas AuthorDate: Wed Oct 13 18:29:30 2021 +0100 Add tests case

[tomcat] 01/02: Add option to reject "suspicious" URIs

2021-10-14 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git commit 7095d1b9c8910c3bb647f0c496eba13b3aa7410a Author: Mark Thomas AuthorDate: Thu Oct 14 13:44:52 2021 +0100 Add option to

[tomcat] branch main updated (d33cce6 -> fee1f45)

2021-10-14 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a change to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git. from d33cce6 Ensure request URIs start with / new 7095d1b Add option to reject "suspicious" URIs new fee1f45 Add

Re: [tomcat] branch main updated: Do not add a trailing / to a request URI during canonicalization.

2021-10-14 Thread Rémy Maucherat
On Thu, Oct 14, 2021 at 11:40 AM Mark Thomas wrote: > > On 14/10/2021 10:25, Konstantin Kolinko wrote: > > чт, 14 окт. 2021 г. в 11:25, Mark Thomas : > >> > >> On 14/10/2021 09:22, ma...@apache.org wrote: > >>> This is an automated email from the ASF dual-hosted git repository. > >>> > >>> markt p

Re: [tomcat] branch main updated: Ensure request URIs start with /

2021-10-14 Thread Konstantin Kolinko
чт, 14 окт. 2021 г. в 13:37, Mark Thomas : > > On 14/10/2021 11:32, Konstantin Kolinko wrote: > > чт, 14 окт. 2021 г. в 13:01, Mark Thomas : > >> > >> On 14/10/2021 10:59, ma...@apache.org wrote: > >>> This is an automated email from the ASF dual-hosted git repository. > >>> > >>> markt pushed a co

Re: [tomcat] branch main updated: Ensure request URIs start with /

2021-10-14 Thread Mark Thomas
On 14/10/2021 11:32, Konstantin Kolinko wrote: чт, 14 окт. 2021 г. в 13:01, Mark Thomas : On 14/10/2021 10:59, ma...@apache.org wrote: This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tom

Re: [tomcat] branch main updated: Ensure request URIs start with /

2021-10-14 Thread Konstantin Kolinko
чт, 14 окт. 2021 г. в 13:01, Mark Thomas : > > On 14/10/2021 10:59, ma...@apache.org wrote: > > This is an automated email from the ASF dual-hosted git repository. > > > > markt pushed a commit to branch main > > in repository https://gitbox.apache.org/repos/asf/tomcat.git > > > > > > The following

Re: [tomcat] branch main updated: Ensure request URIs start with /

2021-10-14 Thread Mark Thomas
On 14/10/2021 10:59, ma...@apache.org wrote: This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/main by this push: new d33cc

[tomcat] branch main updated: Ensure request URIs start with /

2021-10-14 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/main by this push: new d33cce6 Ensure request URIs start with / d33cce6 is

Re: [tomcat] branch main updated: Invalid byte sequences result in a 400 response.

2021-10-14 Thread Mark Thomas
On 14/10/2021 10:34, ma...@apache.org wrote: This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/main by this push: new c4f88

Re: [tomcat] branch main updated: Do not add a trailing / to a request URI during canonicalization.

2021-10-14 Thread Mark Thomas
On 14/10/2021 10:25, Konstantin Kolinko wrote: чт, 14 окт. 2021 г. в 11:25, Mark Thomas : On 14/10/2021 09:22, ma...@apache.org wrote: This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tom

[tomcat] branch main updated: Invalid byte sequences result in a 400 response.

2021-10-14 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/main by this push: new c4f881f Invalid byte sequences result in a 400 respo

Re: [tomcat] branch main updated: Do not add a trailing / to a request URI during canonicalization.

2021-10-14 Thread Konstantin Kolinko
чт, 14 окт. 2021 г. в 11:25, Mark Thomas : > > On 14/10/2021 09:22, ma...@apache.org wrote: > > This is an automated email from the ASF dual-hosted git repository. > > > > markt pushed a commit to branch main > > in repository https://gitbox.apache.org/repos/asf/tomcat.git > > > > > > The following

Re: [tomcat] branch main updated: Do not add a trailing / to a request URI during canonicalization.

2021-10-14 Thread Mark Thomas
On 14/10/2021 09:22, ma...@apache.org wrote: This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/main by this push: new 70d4e

[tomcat] branch main updated: Do not add a trailing / to a request URI during canonicalization.

2021-10-14 Thread markt
This is an automated email from the ASF dual-hosted git repository. markt pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git The following commit(s) were added to refs/heads/main by this push: new 70d4e9b Do not add a trailing / to a request URI dur