Mailing-List: contact tomcat-dev-help@jakarta.apache.org; run by ezmlm
Message-ID: <019c01c386c7$427dcb20$ec66a8c0@bbarkerxp>
From: "Bill Barker" <wbarker@wilshire.com>
To: "Tomcat Developers List" <tomcat-dev@jakarta.apache.org>
References: <9C5166762F311146951505C6790A9CF8013DF3A7@US-VS1.corp.mpi.com>
    <012301c386c0$6d943c60$ec66a8c0@bbarkerxp>
 <3279.208.48.139.163.1064864027.squirrel@www.greenhydrant.com>
Subject: Re: Jakarta Tomcat 4.1 XSS vulnerability
Date: Mon, 29 Sep 2003 13:21:26 -0700
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_1064866843-14822-276"

------------=_1064866843-14822-276
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

----- Original Message -----
From: "David Rees" <dbr@greenhydrant.com>
To: "Tomcat Developers List" <tomcat-dev@jakarta.apache.org>
Sent: Monday, September 29, 2003 12:33 PM
Subject: Re: Jakarta Tomcat 4.1 XSS vulnerability


> On Mon, September 29, 2003 1at 2:32 pm, Bill Barker sent the following
> > Remy has already patched the HTTP Connector for this one (both Tomcat
> > 4&5). I believe that the patch still needs to be ported to the JK2
> > Connector.
>
> Thanks for the update, Bill.  Hope to see Tomcat 4.1.28 out soon, look
> like we could be seeing it as soon as next week.
>

Ok, that's what I get for working from memory.  Actually, Remy's patch is
currently only in TC 5.  It still needs to be applied to TC 4 (as well as
the JK2 Connector for both versions).

> Thanks,
> Dave
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
>


------------=_1064866843-14822-276
Content-Type: text/plain; name="disclaimer.txt"
Content-Disposition: inline; filename="disclaimer.txt"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)


This message is intended only for the use of the person(s) listed above as the intended recipient(s), and may contain information that is PRIVILEGED and CONFIDENTIAL.  If you are not an intended recipient, you may not read, copy, or distribute this message or any attachment. If you received this communication in error, please notify us immediately by e-mail and then delete all copies of this message and any attachments.

In addition you should be aware that ordinary (unencrypted) e-mail sent through the Internet is not secure. Do not send confidential or sensitive information, such as social security numbers, account numbers, personal identification numbers and passwords, to us via ordinary (unencrypted) e-mail.

------------=_1064866843-14822-276--