Dealing with the Tomcat 3.3 "aux.jsp" DOS problem and a Tomcat 3. 3.1 release

[Larry Isaacs <La...@sas.com>]

Hi All,
 
With the amount of spare time I have at the moment, I am not
able to put together a Tomcat 3.3.1 release in short order.
Doing things quickly is not my forte and the earliest I could
do a 3.3.1-beta1 would be the following weekend, i.e.
the weekend of the 20th.
 
In addition, I would rather not leave Tomcat 3.3 with the
"aux.jsp" DOS problem for that duration.  I propose to add
to the site an updated tomcat_util.jar and tomcat_modules.jar
that fix the problem based the changes used in Tomcat 3.3.1.
The updated source files would be made available as well
on the site.  Following the patch, I would announce its
availability and reason for existence on the usual mailing lists.
 
Since, IMHO, it makes no sense to do any branching on the
Tomcat 3.3 track, I propose to add a "patches/tomcat33"
folder under "proposals" and use it as the location in CVS
in which to keep the 3.3 updated Java files.  I'm not
a CVS guru, so let me know if there is a better way to
deal with files like this.
 
Does anyone have a better suggestion about dealing with
the current DOS vunlerability in Tomcat 3.3 (and/or
has more time than I do and wants to volunteer to be
release manager :-) )?
 
If there are no objections or other suggestions, I'll proceed
with the Tomcat 3.3 patch and then start preparing a 3.3.1
release plan.
 
Cheers,
Larry Isaacs
 
 

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>

Re: Dealing with the Tomcat 3.3 "aux.jsp" DOS problem and a Tomcat 3. 3.1 release

[Bill Barker <wb...@wilshire.com>]

----- Original Message -----
From: "Bojan Smojver" <bo...@binarix.com>
To: "Tomcat Developers List" <to...@jakarta.apache.org>
Sent: Wednesday, January 09, 2002 5:26 PM
Subject: Re: Dealing with the Tomcat 3.3 "aux.jsp" DOS problem and a Tomcat
3. 3.1 release


> cmanolache@yahoo.com wrote:
>
> > So far the changes in 3.3 tree were only bug fixes and
> > what I've seen so far was pretty clear and simple -
> > I think the head of 3.3 is as good or better than 3.3.0.
>
>
> There were a few new features as well (at least STM pooling and
> SSLSessionID checks), but they should be either fairly safe (STM
> pooling) or turned off by default (SSLSessionID's). I agree that the
> current CVS version of 3.3 is better then the released 3.3. Many bugs
> have been fixed.
And let's not forget PureTLS support.
>
>
> > We could also take 3.3.0, replace tomcat_utils.jar
> > and label it 3.3.1  - and then in 2-3 weeks release
> > 3.3.2 with te head.
>
>
> Why don't we just say that due to recently discovered security issues,
> the release schedule has been changed and 3.3.1 is out with the latest
> security fixes. Then 3.3.2 gets released later in an orderly fashion.
>
This would be my preference.  There are currently 18 bugs open against 3.3
(about half of them having to do with connectors).  It would be nice to get
a chance to close them before 3.3.2.
>
> > But I'm +1 on whatever you choose. Let me know if/how
> > I can help - I don't have time but I could sleep less :-)
>
>
> I concur with Costin here. Your pick is +1.
me2
>
> Bojan
>
>
> --
> To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
> For additional commands, e-mail:
<ma...@jakarta.apache.org>
>


--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>

Re: Dealing with the Tomcat 3.3 "aux.jsp" DOS problem and a Tomcat 3. 3.1 release

[Bojan Smojver <bo...@binarix.com>]

cmanolache@yahoo.com wrote:

> So far the changes in 3.3 tree were only bug fixes and
> what I've seen so far was pretty clear and simple -
> I think the head of 3.3 is as good or better than 3.3.0.


There were a few new features as well (at least STM pooling and 
SSLSessionID checks), but they should be either fairly safe (STM 
pooling) or turned off by default (SSLSessionID's). I agree that the 
current CVS version of 3.3 is better then the released 3.3. Many bugs 
have been fixed.


> We could also take 3.3.0, replace tomcat_utils.jar
> and label it 3.3.1  - and then in 2-3 weeks release
> 3.3.2 with te head.


Why don't we just say that due to recently discovered security issues, 
the release schedule has been changed and 3.3.1 is out with the latest 
security fixes. Then 3.3.2 gets released later in an orderly fashion.


> But I'm +1 on whatever you choose. Let me know if/how
> I can help - I don't have time but I could sleep less :-)


I concur with Costin here. Your pick is +1.

Bojan


--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>

Re: Dealing with the Tomcat 3.3 "aux.jsp" DOS problem and a Tomcat 3. 3.1 release

[cm...@yahoo.com]

So far the changes in 3.3 tree were only bug fixes and
what I've seen so far was pretty clear and simple -
I think the head of 3.3 is as good or better than 3.3.0.

We could also take 3.3.0, replace tomcat_utils.jar
and label it 3.3.1  - and then in 2-3 weeks release
3.3.2 with te head.

But I'm +1 on whatever you choose. Let me know if/how
I can help - I don't have time but I could sleep less :-)


Costin

On Wed, 9 Jan 2002, Larry Isaacs wrote:

> Hi All,
>
> With the amount of spare time I have at the moment, I am not
> able to put together a Tomcat 3.3.1 release in short order.
> Doing things quickly is not my forte and the earliest I could
> do a 3.3.1-beta1 would be the following weekend, i.e.
> the weekend of the 20th.
>
> In addition, I would rather not leave Tomcat 3.3 with the
> "aux.jsp" DOS problem for that duration.  I propose to add
> to the site an updated tomcat_util.jar and tomcat_modules.jar
> that fix the problem based the changes used in Tomcat 3.3.1.
> The updated source files would be made available as well
> on the site.  Following the patch, I would announce its
> availability and reason for existence on the usual mailing lists.
>
> Since, IMHO, it makes no sense to do any branching on the
> Tomcat 3.3 track, I propose to add a "patches/tomcat33"
> folder under "proposals" and use it as the location in CVS
> in which to keep the 3.3 updated Java files.  I'm not
> a CVS guru, so let me know if there is a better way to
> deal with files like this.
>
> Does anyone have a better suggestion about dealing with
> the current DOS vunlerability in Tomcat 3.3 (and/or
> has more time than I do and wants to volunteer to be
> release manager :-) )?
>
> If there are no objections or other suggestions, I'll proceed
> with the Tomcat 3.3 patch and then start preparing a 3.3.1
> release plan.
>
> Cheers,
> Larry Isaacs
>
>
>
> --
> To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>
>


--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>