Issued:

2015-07-22

Updated:

2015-07-22

RHBA-2015:1461 - tomcat6 bug fix and enhancement update

Synopsis

tomcat6 bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

Updated tomcat6 packages that fix several bugs and add two enhancements are now available for Red Hat Enterprise Linux 6.

Description

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

This update fixes the following bugs:

• Previously, in /etc/init.d/tomcat6, the checkpidfile function did not return correct values when the PID file and a matching /proc/${kpid} existed. This caused the status function to use pgrep to look for processes, which showed any other java processes running as the same user. A fix has been applied, and the checkpidfile function now works as expected. (BZ#746842)

• Before this update, the tomcat6 init script did not kill the tomcat process if an attempt to stop it was unsuccessful, which prevented tomcat from restarting properly. The init script has been modified to correct this issue. (BZ#1022061)

• After upgrading from Apache 6.0.20 to a higher version, the file response from the server could be empty in some cases, and empty files without error logs were generated. A patch has been backported, and logs now contain normal responses. (BZ#1031327)

• Previously, the tomcat6 service restart incorrectly caused duplication in JVM command-line arguments, and the "-Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory" duplicate argument appeared. This has been fixed, and tomcat6 now starts without duplicate JVM arguments. (BZ#1042811)

• After updating tomcat6-admin-webapps, the "/var/lib/tomcat6/webapps/manager/WEB-INF/web.xml" file was overwritten with a file from the new RPM without notifying the user. This destroyed custom changes made to the file, such as additional roles. The file has been marked as %config in the RPM .spec file. Now, the original file is retained, and the file from RPM is installed as "/var/lib/tomcat6/webapps/manager/WEB-INF/web.xml.rpmnew". (BZ#1054817)

• Requests using chunked transfer encoding generated a "NullPointerException" in the parseHeader() function of ChunkedInputFilter.java when the last chunk was processed. Consequently, HTTP connection was aborted by tomcat. The underlying code has been amended, and HTTP connection is no longer lost in this situation. (BZ#1128396)

• Previously, processing a large file, over 1.8 MB in size, by tomcat could lead to an "IOException", and the file was not processed completely. A patch has been applied, and tomcat now processes such files without problems. (BZ#1183252)

• After upgrading from tomcat6-6.0.24-83 to tomcat6-6.0.24-84, it was not possible to install the IPA server with tomcat6-6.0.24-84, and the "Failed to restart the certificate server" message was displayed. A fix has been applied, and the IPA server can now be installed successfully in this situation. (BZ#1202759)

In addition, this update adds the following enhancements:

• Tomcat 6 can now be installed without a GUI. The dependency on redhat-lsb has been removed, and it is now possible to install Tomcat 6 with a reduced number of installed components without a GUI. (BZ#844307, BZ#857356)

• Tomcat log file rotation can now be disabled. By default, Tomcat log files are rotated on the first write operation which occurs after midnight, and given the file name {prefix}{date}{suffix}, where the format for date is YYYY-MM-DD. To allow Tomcat log file rotation to be disabled, the parameter "rotatable" has been added. If this parameter is set to "false", the log file is not rotated and the file name is {prefix}{suffix}. The default value is "true". (BZ#1068689)

Users of tomcat6 are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• tomcat6-lib-6.0.24-90.el6.s390x.rpm
• tomcat6-webapps-6.0.24-90.el6.s390x.rpm
• tomcat6-docs-webapp-6.0.24-90.el6.x86_64.rpm
• tomcat6-6.0.24-90.el6.ppc64.rpm
• tomcat6-docs-webapp-6.0.24-90.el6.ppc64.rpm
• tomcat6-javadoc-6.0.24-90.el6.x86_64.rpm
• tomcat6-servlet-2.5-api-6.0.24-90.el6.ppc64.rpm
• tomcat6-lib-6.0.24-90.el6.i686.rpm
• tomcat6-debuginfo-6.0.24-90.el6.s390x.rpm
• tomcat6-webapps-6.0.24-90.el6.ppc64.rpm
• tomcat6-javadoc-6.0.24-90.el6.ppc64.rpm
• tomcat6-6.0.24-90.el6.x86_64.rpm
• tomcat6-6.0.24-90.el6.s390x.rpm
• tomcat6-debuginfo-6.0.24-90.el6.ppc64.rpm
• tomcat6-webapps-6.0.24-90.el6.x86_64.rpm
• tomcat6-docs-webapp-6.0.24-90.el6.i686.rpm
• tomcat6-servlet-2.5-api-6.0.24-90.el6.x86_64.rpm
• tomcat6-debuginfo-6.0.24-90.el6.x86_64.rpm
• tomcat6-lib-6.0.24-90.el6.x86_64.rpm
• tomcat6-el-2.1-api-6.0.24-90.el6.i686.rpm
• tomcat6-webapps-6.0.24-90.el6.i686.rpm
• tomcat6-servlet-2.5-api-6.0.24-90.el6.s390x.rpm
• tomcat6-6.0.24-90.el6.i686.rpm
• tomcat6-docs-webapp-6.0.24-90.el6.s390x.rpm
• tomcat6-jsp-2.1-api-6.0.24-90.el6.s390x.rpm
• tomcat6-el-2.1-api-6.0.24-90.el6.s390x.rpm
• tomcat6-jsp-2.1-api-6.0.24-90.el6.i686.rpm
• tomcat6-admin-webapps-6.0.24-90.el6.s390x.rpm
• tomcat6-jsp-2.1-api-6.0.24-90.el6.x86_64.rpm
• tomcat6-admin-webapps-6.0.24-90.el6.ppc64.rpm
• tomcat6-admin-webapps-6.0.24-90.el6.i686.rpm
• tomcat6-javadoc-6.0.24-90.el6.i686.rpm
• tomcat6-servlet-2.5-api-6.0.24-90.el6.i686.rpm
• tomcat6-lib-6.0.24-90.el6.ppc64.rpm
• tomcat6-javadoc-6.0.24-90.el6.s390x.rpm
• tomcat6-6.0.24-90.el6.src.rpm
• tomcat6-admin-webapps-6.0.24-90.el6.x86_64.rpm
• tomcat6-jsp-2.1-api-6.0.24-90.el6.ppc64.rpm
• tomcat6-debuginfo-6.0.24-90.el6.i686.rpm
• tomcat6-el-2.1-api-6.0.24-90.el6.x86_64.rpm
• tomcat6-el-2.1-api-6.0.24-90.el6.ppc64.rpm

Fixes

• This content is not included.BZ - 746842
• This content is not included.BZ - 844307
• This content is not included.BZ - 857356
• This content is not included.BZ - 1042811
• This content is not included.BZ - 1128396
• This content is not included.BZ - 1202759

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.