*** Security alert *** & 3.1 beta 1 refresh

[ru...@us.ibm.com]

Advisory:

   Delivered with Tomcat is an example (jsp/source.jsp) that can be used to
   deliver the contents of any file on your machine.

Recommended action:

   The simplest course of action is to simply remove this example from your
   machine.  Alternatively, you can replace the associated ShowSource.class
   file with one from the current 3.1 beta.

Fixes:

   Fixes have been made to the core of Tomcat to not allow any file
   references to be resolved outside of the context being used for the
   resolution.  Additionally, a change has been made to ShowSource.java to
   disallow any requests which contain the string "..".

   The 3.1 beta 1 release has been refreshed with these fixes applied.

The Tomcat development team apologizes for any inconvenience this may
cause.  I would also like to take the opportunity to thank Jan Madsen at
SecurityWorkers for bringing this to our attention.

- Sam Ruby