<div>Hi Nate,</div>Here is the response from Redhat Developer, who is responsible for Tomcat5 release on Redhat 5x systems.<div>Is it possible for the Shib Development Team to revisit this issue??</div><div><br></div><div>
<div><div><span class="Apple-style-span" style="font-family:Times;font-size:medium"><pre style="word-wrap:break-word;white-space:pre-wrap">-----</pre><pre style="word-wrap:break-word;white-space:pre-wrap">From: dknox <<a href="mailto:dknox@redhat.com">dknox@redhat.com</a>>
To: Dhivakaran Muruganantham <<a href="mailto:dmuruganantham@lbl.gov">dmuruganantham@lbl.gov</a>>
Subject: Re: Tomcat5 package on Redhat EL 5
Hi Dhiva,
As far as I can tell, the bug you reference was part of the patch for CVE-2007-5333 (rhbz 427780) that has been applied since RHEL-5/tomcat5.5.23-0jpp.9.el5. The most recent RHEL-5 release is tomcat5-5.5.23-0jpp.27.el5. Note the patch introduces a system property "org.apache.tomcat.util.http.ServerCookie.VERSION_SWITCH" that ensures quotes are escaped. The default value is true. I recommend the customer use the default which should be adequate for both version 1 and version 2 cookie parsing.
The fix is already in tomcat6/RHEL6 as it was originaly patched in tomcat-6.0.16. RHEL-6 is at 6.0.24
Don't know where the customer got the idea that it wouldn't be fixed in tomcat5. Also don't know anything about Shib IDP, so it's difficult to answer your question succinctly. Tomcat5-5.5.23 uses servlet 2.4, so if that is the only requirement, it should work.
hope this helps,
-- david</pre><pre style="word-wrap:break-word;white-space:pre-wrap">-----</pre><pre style="word-wrap:break-word;white-space:pre-wrap"><br></pre><pre style="word-wrap:break-word;white-space:pre-wrap">thanks</pre><pre style="word-wrap:break-word;white-space:pre-wrap">
dhiva</pre><pre style="word-wrap:break-word;white-space:pre-wrap"><br></pre></span></div><div><br><div class="gmail_quote">
On Thu, Jan 26, 2012 at 1:56 PM, Aaron Roots <span dir="ltr"><<a href="mailto:aaron.roots@deakin.edu.au" target="_blank">aaron.roots@deakin.edu.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="font-size:14px;font-family:Calibri,sans-serif;word-wrap:break-word">
<div>Also if you can get to Centos6 or Redhat6 – tomcat6 is provided in the base repos. We are currently running this version without issue.</div>
<div><br>
</div>
<div>Cheers</div>
<div>Aaron</div>
<div><br>
</div>
<span>
<div style="border-right:medium none;padding-right:0in;padding-left:0in;padding-top:3pt;text-align:left;font-size:11pt;border-bottom:medium none;font-family:Calibri;border-top:#b5c4df 1pt solid;padding-bottom:0in;border-left:medium none">
<span style="font-weight:bold">From: </span>Dhivakaran Muruganantham <<a href="mailto:dmuruganantham@lbl.gov" target="_blank">dmuruganantham@lbl.gov</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Wed, 25 Jan 2012 15:32:42 -0800<br>
<span style="font-weight:bold">To: </span>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><div><br>
<span style="font-weight:bold">Subject: </span>Re: [SciFed] Tomcat 6 requirement for Shib IDP<br>
</div></div><div><div>
<div><br>
</div>
<blockquote style="BORDER-LEFT:#b5c4df 5 solid;PADDING:0 0 0 5;MARGIN:0 0 0 5">
Thanks Peter. Useful to know and I am going to try it on Dev machines.
<div>We do use other repos along with RHN. The problem is that jpackage.repo became out sync.</div>
<div><br>
<div>
<div>Forwarded the Tomcat5 bug that Nate mentioned to the Redhat Developer responsible for Tomcat5 release.</div>
<div>Here is the reply...</div>
<div><span style="border-collapse:collapse;color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">>>>></span></div>
<div><span style="border-collapse:collapse;color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif">Hi Dhiva,<br>
I recall that bug. I can take a closer look Thursday.<br>
<br>
cheers,<br>
-- david</span></div>
<div><span style="border-collapse:collapse;color:rgb(34,34,34);font-size:13px;font-family:arial,sans-serif"><<<<<</span></div>
<div><br>
<div class="gmail_quote">On Wed, Jan 25, 2012 at 2:34 PM, Peter Schober <span dir="ltr">
<<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
* Dhivakaran Muruganantham <<a href="mailto:dmuruganantham@lbl.gov" target="_blank">dmuruganantham@lbl.gov</a>>
<a href="tel:%5B2012-01-25%2019" value="+12012012519" target="_blank">[2012-01-25 19</a>:36]:<br>
<div>> I don't think i am the only one, interested in running CentOS/Redhat<br>
> platform.<br>
> Doing a 'yum' install using the Standard repo is always preferred method,<br>
> instead of downloading a generic package. I think.<br>
<br>
</div>
The best (e.g. most flexible, least cruft) S/RPM packages for Tomcat<br>
I've seen are the ones provided by Jason Brittain. They used to be on<br>
his personal website and seemingly have found a new home at<br>
<a href="http://code.google.com/p/webdroid-tomcat-package/" target="_blank">http://code.google.com/p/webdroid-tomcat-package/</a><br>
For `yum install` you'd need to import the packages into a repo of<br>
your own. We use our RHN Satellite but createrepo (or others) will do<br>
just fine.<br>
<span><font color="#888888">-peter<br>
</font></span>
<div>
<div>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</div>
-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a></blockquote>
</div></div></span>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>
</div></div>