Path: csiph.com!news.freedyn.net!aioe.org!bofh.it!news.nic.it!robomod
From: Emmanuel Bourg <ebourg@apache.org>
Newsgroups: linux.debian.maint.java
Subject: Re: Tomcat 6 security vulnerabilities in Wheezy
Date: Thu, 18 Feb 2016 18:20:02 +0100
Message-ID: <r3Apc-pQ-11@gated-at.bofh.it>
References: <r3x7Y-6f7-13@gated-at.bofh.it>
Old-Return-Path: <emmanuel.bourg@gmail.com>
Sender: robomod@news.nic.it
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Approved: robomod@news.nic.it
Lines: 23
Organization: linux.* mail to news gateway
Xref: csiph.com linux.debian.maint.java:8886

Le 18/02/2016 14:45, Markus Koschany a écrit :

> According to [1] Tomcat 6 in Wheezy is still affected by a couple of
> security vulnerabilities that were already fixed in Squeeze-LTS and
> Jessie. Would it be sensible to apply the same changes (backporting the
> 6.0.41 release to Wheezy too) or are there any reasons why this has not
> been done before? Has anybody spoken with the Security Team about Tomcat
> security updates in general? Do they approve of backporting newer
> upstream releases?

Hi Markus,

I vaguely remember trying to backport the fixes and giving up due to the
complexity. Also the lack of tests in Tomcat 6 makes this operation
rather risky. That's why the LTS Team decided to package a more recent
release in Squeeze.

I don't know if the Security Team would accept a new upstream release
for Wheezy. Since the LTS Team is probably going to upgrade the package
when they take over the maintenance in April we could ask the Security
Team to do this upgrade earlier.

Emmanuel Bourg