You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Mark Thomas <ma...@apache.org> on 2016/05/25 17:52:29 UTC
[ANN] Apache Tomcat 8.0.35 available
Apologies for the delay in sending this out.
The Apache Tomcat team announces the immediate availability of Apache
Tomcat 8.0.35.
Apache Tomcat 8.0 is an open source software implementation of the Java
Servlet, JavaServer Pages, Java Unified Expression Language and Java
WebSocket technologies.
Apache Tomcat 8.0.35 includes fixes for issues identified in 8.0.33 as
well as other enhancements and changes. The notable changes since 8.0.33
include:
- Make the default TLS configuration more secure.
- Update the packaged version of the Tomcat Native Library to 1.2.7
to pick up the Windows binaries that are based on OpenSSL 1.0.2h
and APR 1.5.2.
Please refer to the change log for the complete list of changes:
http://tomcat.apache.org/tomcat-8.0-doc/changelog.html
Downloads:
http://tomcat.apache.org/download-80.cgi
Migration guides from Apache Tomcat 5.5.x, 6.0.x and 7.0.x:
http://tomcat.apache.org/migration.html
Enjoy!
- The Apache Tomcat team
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [ANN] Apache Tomcat 8.0.35 available
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
David,
On 5/25/16 2:05 PM, David Wall wrote:
> Does anybody know if the AES+GCM bug that causes a JVM Crash (I
> believe only under JDK 8) when running TLS in Tomcat using Java's
> JSSE has been fixed? I doubt this is a Tomcat issue, but since the
> bug likely only appears for uses of TLS's AES+GCM in Tomcat, I hope
> someone here may know the details. I can't seem to track the fix
> (it's a rather old bug considering the severity of a JVM crash just
> using TLS) in Java.
Do you have a reference for such a crash? Are you talking about this one
?
https://bugs.openjdk.java.net/browse/JDK-8068663
I don't have an OpenJDK account, so I can't (currently) see the status
of the bug that one claims to duplicate.
Since you are using JSSE, Tomcat is using 100% Java code, so the crash
is squarely a JVM bug.
- -chris
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJXSIY2AAoJEBzwKT+lPKRYHOYQAMChD3vcLWQEvZiEYKk6tFBL
MghQZlk+DVDnKg4kZGzYq5t5ru4fqwB/sKkfY/Hv2KfJNf6ENpXUM5bAB327JIXY
fuYyqSGgbJLSzFlxxoQAg9HsFm2DPFFoY6YMKt2E0whi1DlGZ10noTrwFnvWsiCb
NgV2b2A7vJUNA9/V3sRTxp9bNyRhP9jTZNy8L/4MkruHXeh7tbZZsnqO/BzSn10T
yRU06uLTyPnPUv/1egvmXiD8Qxjd14ubasxep/D9xv3e4Vi5YRXdD36unsZB5gVr
1iQaZ6uPm5h0kfgDKf3FMImWJ+o78Ls+bBWfNJf+PqBaS3/jexDv39MxPeAWUK/J
8z1D6FOTOZCv9UwCZUr0zCvS3UyJMdJThiicwGQmeGzSaYCiHFu7ExJOB9X43zzu
HlmUd0iRZw2eL8nemkaktFHVJpCMC4YE3WRP1wzv20uGrp97gnvzEdA73eYL6v4l
71BEsyfRrOK+f/atYf5w5fw75kbF+rjCj8QYFWnU0qUwgBBkSoCbYSvF7uUG4Y4N
LMAo+eIRkKGIGBEnr/UlXyVF+dvM4nU2sWElt0qVVJzQhLTXWPvhwUAIC54aAYvF
OoE7sQwIc98/jzJ1wKfB9kYTQ2BtL+lcqUNKGb4IvUXMOgtCzDUogBKZ47R6l/yH
FCAn6FhtrcqeEj9mwupe
=DjPU
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [ANN] Apache Tomcat 8.0.35 available
Posted by David Wall <d....@computer.org>.
Does anybody know if the AES+GCM bug that causes a JVM Crash (I believe
only under JDK 8) when running TLS in Tomcat using Java's JSSE has been
fixed? I doubt this is a Tomcat issue, but since the bug likely only
appears for uses of TLS's AES+GCM in Tomcat, I hope someone here may
know the details. I can't seem to track the fix (it's a rather old bug
considering the severity of a JVM crash just using TLS) in Java.
Thanks,
David
On 5/25/16 10:52 AM, Mark Thomas wrote:
> Apologies for the delay in sending this out.
>
> The Apache Tomcat team announces the immediate availability of Apache
> Tomcat 8.0.35.
>
> Apache Tomcat 8.0 is an open source software implementation of the Java
> Servlet, JavaServer Pages, Java Unified Expression Language and Java
> WebSocket technologies.
>
> Apache Tomcat 8.0.35 includes fixes for issues identified in 8.0.33 as
> well as other enhancements and changes. The notable changes since 8.0.33
> include:
>
> - Make the default TLS configuration more secure.
>
> - Update the packaged version of the Tomcat Native Library to 1.2.7
> to pick up the Windows binaries that are based on OpenSSL 1.0.2h
> and APR 1.5.2.
>
> Please refer to the change log for the complete list of changes:
> http://tomcat.apache.org/tomcat-8.0-doc/changelog.html
>
> Downloads:
> http://tomcat.apache.org/download-80.cgi
>
> Migration guides from Apache Tomcat 5.5.x, 6.0.x and 7.0.x:
> http://tomcat.apache.org/migration.html
>
> Enjoy!
>
> - The Apache Tomcat team
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org