- Update to Tomcat 10.1.20
  * Fixed CVEs:
    + CVE-2024-24549: Improved request header validation for HTTP/2 stream 
      (bsc#1221386)
    + CVE-2024-23672: Ensure that WebSocket connection closure completes if 
      the connection is closed when the server side has used the proprietary 
      suspend/resume feature to suspend the connection (bsc#1221385) 
  * Catalina
    + Fix:  Minor performance improvement for building filter chains. 
      Based on ideas from #702 by Luke Miao. (remm)
    + Fix:  Align error handling for Writer and OutputStream. Ensure 
      use of either once the response has been recycled triggers a 
      NullPointerException provided that discardFacades is configured with 
      the default value of true. (markt)
    + Fix:  68692: The standard thread pool implementations that are 
      configured using the Executor element now implement ExecutorService 
      for better support NIO2. (remm)
    + Fix:  68495: When restoring a saved POST request after a 
      successful FORM authentication, ensure that neither the URI, the 
      query string nor the protocol are corrupted when restoring the 
      request body. (markt)
    + Fix:  After forwarding a request, attempt to unwrap the 
      response in order to suspend it, instead of simply closing it if it 
      was wrapped. Add a new suspendWrappedResponseAfterForward boolean 
      attribute on Context to control the bahavior, defaulting to false. 
      (remm)
    + Fix:  68721: Workaround a possible cause of duplicate class 
      definitions when using ClassFileTransformers and the transformation 
      of a class also triggers the loading of the same class. (markt)
    + Fix:  The rewrite valve should not do a rewrite if the output

• Files Changed
• Browse Source