Mailing-List: contact tomcat-dev-help@jakarta.apache.org; run by ezmlm
Message-ID: <3A366846.69F491C7@eng.sun.com>
Date: Tue, 12 Dec 2000 10:02:47 -0800
From: "Craig R. McClanahan" <Craig.McClanahan@eng.sun.com>
MIME-Version: 1.0
To: tomcat-dev@jakarta.apache.org
Subject: Re: [SECURITY] Security Vulnerabilities in Tomcat 3.1 and 3.2
References: <3A357D3D.302585D7@eng.sun.com>
 <3A363F7B.C6DCD6E9@voyager.apg.more.net>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Glenn Nielsen wrote:

> Very shortly I will have some updated documents for configuring Tomcat to use
> the Java SecurityManager under various flavors of MS Windows.  I would like
> to get this into the 3.2.1 release.
>
> +1 If you can hold off a day so I can get these documents updated
>

I would be really uncomfortable holding off security related fixes for "feature"
improvements (or even bug fixes), when we can roll a 3.2.2 release as soon as the
changes are committed and tested.  Keep in mind that we're bypassing the usual "beta
test" period if we release 3.2.1 ASAP, so adding lots of things creates some measure
of risk.


> Regards,
>
> Glenn
>

Craig

PS:  Thanks to Arieh for catching my stupid typo in the fixes for META-INF and WEB-INF
checking ... I will make sure those are repaired before cutting the real releases.