Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: neutral (athena.apache.org: local policy)
Message-ID: <4D6F25A5.8030907@att.net>
Date: Wed, 02 Mar 2011 21:22:45 -0800
From: Michael McCutcheon <michael.mccutcheon@att.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US;
 rv:1.9.2.14) Gecko/20110221 Thunderbird/3.1.8
MIME-Version: 1.0
To: users@tomcat.apache.org
Subject: Re: [SECURITY] Tomcat 7 ignores @ServletSecurity annotations
References: <4D6E74FF.7050106@apache.org>
In-Reply-To: <4D6E74FF.7050106@apache.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

On 3/2/2011 8:49 AM, Mark Thomas wrote:
> As reported on the users list [1], both Tomcat 7.0.8 and the latest
> Tomcat 7 code from svn appear to ignore @ServletSecurity annotations.
> Assuming this issue is confirmed, it may lead to authentication bypass
> and information disclosure.
>
> The exact details are still being investigated but this e-mail is being
> provided to give users early warning of this public issue.
>
> If code changes are required to address this, they will be included in
> the next release of Tomcat 7, 7.0.10. The release process for 7.0.10 is
> expected to start once the investigation of this issue is complete.
>
> Mark
> on behalf of the Apache Tomcat security team

Hello, I was just wondering if there was any update on this issue.

-Mike


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org