Wed, 30 Sep 2026 06:23:47 CST | login

Information for build tomcat-9.0.120-1.oc8

ID48381
Package Nametomcat
Version9.0.120
Release1.oc8
Epoch1
DraftFalse
Sourcegit+https://gitee.com/src-opencloudos-rpms/tomcat.git#67a7954459e2cb23411c47f77da870d25bb31bab
SummaryApache Servlet/JSP Engine, RI for Servlet 4.0/JSP 2.3 API
DescriptionTomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.
Built byoc-bot
State complete
Volume DEFAULT
StartedFri, 18 Sep 2026 11:16:00 CST
CompletedFri, 18 Sep 2026 11:18:49 CST
Taskbuild (dist-oc8, /src-opencloudos-rpms/tomcat.git:67a7954459e2cb23411c47f77da870d25bb31bab)
Extra{'source': {'original_url': 'git+https://gitee.com/src-opencloudos-rpms/tomcat.git#67a7954459e2cb23411c47f77da870d25bb31bab'}}
Tags
dist-oc8
dist-oc8-compose
RPMs
src
tomcat-9.0.120-1.oc8.src.rpm (info) (download)
noarch
tomcat-9.0.120-1.oc8.noarch.rpm (info) (download)
tomcat-admin-webapps-9.0.120-1.oc8.noarch.rpm (info) (download)
tomcat-docs-webapp-9.0.120-1.oc8.noarch.rpm (info) (download)
tomcat-el-3.0-api-9.0.120-1.oc8.noarch.rpm (info) (download)
tomcat-jsp-2.3-api-9.0.120-1.oc8.noarch.rpm (info) (download)
tomcat-lib-9.0.120-1.oc8.noarch.rpm (info) (download)
tomcat-servlet-4.0-api-9.0.120-1.oc8.noarch.rpm (info) (download)
tomcat-webapps-9.0.120-1.oc8.noarch.rpm (info) (download)
Logs
noarch
mock_config.log
installed_pkgs.log
build.log
mock_output.log
state.log
hw_info.log
dnf.log
dnf.librepo.log
root.log
dnf.rpm.log
noarch_rpmdiff.json
Changelog * Fri Jul 31 2026 Pietro Meloni <pmeloni@redhat.com> - 1:9.0.120-1 - Resolves: RHEL-192806 HTTP/2 request headers not validated (CVE-2026-41293) - Resolves: RHEL-219561 Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) - Resolves: RHEL-219581 Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084) - Resolves: RHEL-238206 tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498) - Resolves: RHEL-238213 tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513) - Resolves: RHEL-238260 tomcat: Improper Authorization allows security bypass (CVE-2026-43515) - Resolves: RHEL-238294 tomcat: Authentication bypass via digest authentication (CVE-2026-43512) - Resolves: RHEL-239018 tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957) * Thu Jun 04 2026 Pietro Meloni <pmeloni@redhat.com> - 1:9.0.87-2 - Resolves: RHEL-183993 Remove tomcat clustering JAR from RPM builds * Thu Nov 27 2025 Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.7 - Resolves: RHEL-124507 tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) - Resolves: RHEL-91743 tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) * Thu Aug 14 2025 Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.6 - Resolves: RHEL-102193 tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989) * Tue Aug 12 2025 Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.5 - Resolves: RHEL-108486 tomcat: Apache Commons FileUpload DOS via part headers (CVE-2025-48976) - Resolves: RHEL-108494 tomcat: Dos in multipart upload (CVE-2025-48988) - Resolves: RHEL-108502 tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125) - Resolves: RHEL-108510 tomcat: Denial of service (CVE-2025-52434) - Resolves: RHEL-108524 tomcat: Denial of service (CVE-2025-52520) - Resolves: RHEL-108518 tomcat: Denial of service (CVE-2025-53506) * Mon May 26 2025 Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.4 - Resolves: RHEL-91761 tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650) - Resolves: RHEL-71971 tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337) * Wed Apr 02 2025 Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.3 - Resolves: RHEL-82934 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813) - Resolves: RHEL-71708 tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379) * Thu Aug 08 2024 Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.2 - Resolves: RHEL-46167 tomcat: Improper Handling of Exceptional Conditions (CVE-2024-34750) * Mon Jun 03 2024 Sokratis Zappis <szappis@redhat.com> - 1:9.0.87-1.el8_10.1 - Resolves: RHEL-38548 - Amend tomcat package's changelog so that fixed CVEs are mentioned explicitly - Resolves: RHEL-35813 - Rebase tomcat to version 9.0.87 - Resolves: RHEL-29255 tomcat: Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672) - Resolves: RHEL-29250 tomcat: Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549) * Fri Jan 19 2024 Hui Wang <huwang@redhat.com> - 1:9.0.62-30 - Resolves: RHEL-6971 * Thu Jan 18 2024 Hui Wang <huwang@redhat.com> - 1:9.0.62-29 - Resolves: RHEL-17602 tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589) - tomcat: Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549) * Thu Nov 23 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-28 - Resolves: RHEL-13907 tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648) - Resolves: RHEL-13904 tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795) - Resolves: RHEL-12951 tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794) - Resolves: RHEL-12544 tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) - Resolves: RHEL-2386 tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080) * Fri Oct 13 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-27 - Related: RHEL-12543 tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) - Bump release number * Thu Oct 12 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-16 - Resolves: RHEL-12543 tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) - Remove JDK subpackges which are unused * Fri Sep 08 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-14 - Related: RHEL-2330 Bump release number * Thu Sep 07 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-13 - Resolves: RHEL-2330 Revert the fix for pki-servlet-engine * Fri Aug 25 2023 Coty Sutherland <csutherl@redhat.com> - 1:9.0.62-12 - Related: #2184135 Declare file conflicts * Fri Aug 25 2023 Coty Sutherland <csutherl@redhat.com> - 1:9.0.62-11 - Resolves: #2184135 Fix bug introduced in initial commit * Fri Aug 18 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-10 - Resolves: #2210630 CVE-2023-28709 tomcat - Resolves: #2181448 CVE-2023-28708 tomcat: not including the secure attribute causes information disclosure - tomcat: Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998) tomcat: JsonErrorReportValve injection (CVE-2022-45143) tomcat: request smuggling (CVE-2022-42252) tomcat: local privilege escalation vulnerability (CVE-2022-23181) * Thu Aug 17 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-9 - Resolves: #2184135 Add Obsoletes to tomcat package * Thu Aug 17 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-8 - Resolves: #2189676 Missing Tomcat POM files in RHEL 8.9 * Tue Aug 15 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-7 - Related: #2173874 Tomcat installs older java even though newer java is installed - Bump release number * Fri Aug 11 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-6 - Resolves: #2173874 Tomcat installs older java even though newer java is installed - Sync with rhel-8.8.0 branch * Thu Feb 16 2023 Coty Sutherland <csutherl@redhat.com> - 1:9.0.62-5 - Related: #2160455 Add conflicts to subpackage * Wed Feb 15 2023 Hui Wang <huwang@redhat.com> - 1:9.0.62-4 - Resolves: #2160455 Add Tomcat 9 to RHEL8