Issued:

2015-07-22

Updated:

2015-07-22

RHBA-2015:1316 - tomcatjss bug fix and enhancement update

Synopsis

tomcatjss bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

An updated tomcatjss package that fixes one bug and adds one enhancement is now available for Red Hat Enterprise Linux 6.

Description

The tomcatjss package provides a Java Secure Socket Extension (JSSE) implementation using Java Security Services (JSS) for Tomcat, an open source web server and Java servlet container.

This update fixes the following bug:

• Previously, the init() function in tomcatjss looked for the clientauth attribute which was not present. As a consequence, Tomcat returned NullPointerException in init() on startup, and in addition, some properties, such as enableOSCP and properties for enabling certain SSL ciphers, were not called. A patch has been applied to fix this problem. As a result, NullPointerException no longer occurs in the described situation, and the mentioned properties are called as expected. (BZ#1190911)

In addition, this update adds the following enhancement:

• The Tomcat service has been updated to support the Transport Layer Security cryptographic protocol version 1.1 (TLSv1.1) and the Transport Layer Security cryptographic protocol version 1.2 (TLSv1.2) using JSS. (BZ#1167471)

Users of tomcatjss are advised to upgrade to this updated package, which fixes this bug and adds this enhancement.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• tomcatjss-2.1.0-4.el6.noarch.rpm
• tomcatjss-2.1.0-4.el6.src.rpm

Fixes

• This content is not included.BZ - 1167471
• This content is not included.BZ - 1190911

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.