Update to 9.0.68

Fixes CVE-2022-23181

java-9-start-up-parameters.conf

@@ -0,0 +1,7 @@
+# Add the JAVA 9 specific start-up parameters required by Tomcat
+JDK_JAVA_OPTIONS="$JDK_JAVA_OPTIONS --add-opens=java.base/java.lang=ALL-UNNAMED"
+JDK_JAVA_OPTIONS="$JDK_JAVA_OPTIONS --add-opens=java.base/java.io=ALL-UNNAMED"
+JDK_JAVA_OPTIONS="$JDK_JAVA_OPTIONS --add-opens=java.base/java.util=ALL-UNNAMED"
+JDK_JAVA_OPTIONS="$JDK_JAVA_OPTIONS --add-opens=java.base/java.util.concurrent=ALL-UNNAMED"
+JDK_JAVA_OPTIONS="$JDK_JAVA_OPTIONS --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED"
+export JDK_JAVA_OPTIONS

rhbz-1857043.patch

@@ -1,7 +1,7 @@
 diff -up ./build.xml.orig ./build.xml
 --- build.xml.orig	2021-07-07 10:53:55.493742841 +0800
 +++ build.xml	2021-07-07 11:09:43.107968515 +0800
-@@ -1030,7 +1030,7 @@
+@@ -1020,7 +1020,7 @@
        filesDir="${tomcat.classes}"
        filesId="files.annotations-api"
        manifest="${tomcat.manifests}/annotations-api.jar.manifest"
@@ -10,7 +10,7 @@ diff -up ./build.xml.orig ./build.xml
  
      <!-- Servlet Implementation JAR File -->
      <jarIt jarfile="${servlet-api.jar}"
-@@ -1039,41 +1039,41 @@
+@@ -1029,41 +1029,41 @@
        manifest="${tomcat.manifests}/servlet-api.jar.manifest"
        notice="${tomcat.manifests}/servlet-api.jar.notice"
        license="${tomcat.manifests}/servlet-api.jar.license"
@@ -58,7 +58,7 @@ diff -up ./build.xml.orig ./build.xml
  
      <!-- Bootstrap JAR File -->
      <jarIt jarfile="${bootstrap.jar}"
-@@ -1085,61 +1085,61 @@
+@@ -1075,61 +1075,61 @@
      <jarIt jarfile="${tomcat-util.jar}"
        filesDir="${tomcat.classes}"
        filesId="files.tomcat-util"
@@ -130,7 +130,7 @@ diff -up ./build.xml.orig ./build.xml
  
      <!-- Catalina Ant Tasks JAR File -->
      <jarIt jarfile="${catalina-ant.jar}"
-@@ -1150,27 +1150,27 @@
+@@ -1140,27 +1140,27 @@
      <jarIt jarfile="${catalina-storeconfig.jar}"
        filesDir="${tomcat.classes}"
        filesId="files.catalina-storeconfig"
@@ -162,7 +162,7 @@ diff -up ./build.xml.orig ./build.xml
  
      <!-- i18n JARs -->
      <jar jarfile="${tomcat.build}/lib/tomcat-i18n-cs.jar"
-@@ -1644,7 +1644,7 @@
+@@ -1620,7 +1620,7 @@
             filesId="files.tomcat-embed-core"
             notice="${tomcat.manifests}/servlet-api.jar.notice"
             license="${tomcat.manifests}/servlet-api.jar.license"
@@ -171,7 +171,7 @@ diff -up ./build.xml.orig ./build.xml
             addGraal="true"
             graalPrefix="org.apache.tomcat.embed/tomcat-embed-core"
             graalFiles="res/graal/tomcat-embed-core/native-image"
-@@ -1652,7 +1652,7 @@
+@@ -1628,7 +1628,7 @@
      <jarIt jarfile="${tomcat-embed-el.jar}"
             filesDir="${tomcat.classes}"
             filesId="files.tomcat-embed-el"
@@ -180,7 +180,7 @@ diff -up ./build.xml.orig ./build.xml
             addGraal="true"
             graalPrefix="org.apache.tomcat.embed/tomcat-embed-el"
             graalFiles="res/graal/tomcat-embed-el/native-image"
-@@ -1661,7 +1661,7 @@
+@@ -1637,7 +1637,7 @@
             filesDir="${tomcat.classes}"
             filesId="files.tomcat-embed-jasper"
             meta-inf="${tomcat.manifests}/jasper.jar"
@@ -189,7 +189,7 @@ diff -up ./build.xml.orig ./build.xml
             addGraal="true"
             graalPrefix="org.apache.tomcat.embed/tomcat-embed-jasper"
             graalFiles="res/graal/tomcat-embed-jasper/native-image"
-@@ -1670,7 +1670,7 @@
+@@ -1646,7 +1646,7 @@
             filesDir="${tomcat.classes}"
             filesId="files.tomcat-embed-websocket"
             meta-inf="${tomcat.manifests}/tomcat-websocket.jar"

sources

@@ -1 +1 @@
-SHA512 (apache-tomcat-9.0.50-src.tar.gz) = 1032d2d5c342fb495b76426fdc301e0e5546815e709e604061d7aa2cdab19bcd376adc957fd25dee1d574306186eafd2e9d24140dd5e725b130128592cac47a2
+SHA512 (apache-tomcat-9.0.68-src.tar.gz) = 63bb2c42f683c4c5e362b19bda046de172382714e80298106c61cc728feea9681b568450f04cb95d6cae08e5a71933c7755b9b81b706c46d63f4683c2a3a96be

tomcat-9.0-JDTCompiler.patch

@@ -1,16 +1,17 @@
-diff -up ./java/org/apache/jasper/compiler/JDTCompiler.java.orig ./java/org/apache/jasper/compiler/JDTCompiler.java
---- java/org/apache/jasper/compiler/JDTCompiler.java.orig	2021-07-07 11:31:21.583507995 +0800
-+++ java/org/apache/jasper/compiler/JDTCompiler.java	2021-07-07 11:35:13.009251246 +0800
-@@ -310,7 +310,7 @@ public class JDTCompiler extends org.apa
+diff -up ./java/org/apache/jasper/compiler/JDTCompiler.java ./java/org/apache/jasper/compiler/JDTCompiler.java
+index 2e361f2..277d8f4 100644
+--- java/org/apache/jasper/compiler/JDTCompiler.java
++++ java/org/apache/jasper/compiler/JDTCompiler.java
+@@ -310,7 +310,7 @@ public class JDTCompiler extends org.apache.jasper.compiler.Compiler {
              } else if(opt.equals("15")) {
                  settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_15);
              } else if(opt.equals("16")) {
 -                settings.put(CompilerOptions.OPTION_Source, CompilerOptions.VERSION_16);
 +                settings.put(CompilerOptions.OPTION_Source, "16");
              } else if(opt.equals("17")) {
-                 // Constant not available in latest ECJ version shipped with
-                 // Tomcat. May be supported in a snapshot build.
-@@ -372,8 +372,8 @@ public class JDTCompiler extends org.apa
+                 // Constant not available in latest ECJ version that runs on
+                 // Java 8.
+@@ -377,8 +377,8 @@ public class JDTCompiler extends org.apache.jasper.compiler.Compiler {
                  settings.put(CompilerOptions.OPTION_TargetPlatform, CompilerOptions.VERSION_15);
                  settings.put(CompilerOptions.OPTION_Compliance, CompilerOptions.VERSION_15);
              } else if(opt.equals("16")) {
@@ -19,5 +20,5 @@ diff -up ./java/org/apache/jasper/compiler/JDTCompiler.java.orig ./java/org/apac
 +                settings.put(CompilerOptions.OPTION_TargetPlatform, "16");
 +                settings.put(CompilerOptions.OPTION_Compliance, "16");
              } else if(opt.equals("17")) {
-                 // Constant not available in latest ECJ version shipped with
-                 // Tomcat. May be supported in a snapshot build.
+                 // Constant not available in latest ECJ version that runs on
+                 // Java 8.

tomcat-9.0-catalina-policy.patch

@@ -1,6 +1,6 @@
---- conf/catalina.policy.orig	2021-07-07 10:25:53.461393329 +0800
-+++ conf/catalina.policy	2021-07-07 10:27:47.688682404 +0800
-@@ -56,6 +56,16 @@ grant codeBase "file:${java.home}/lib/ex
+--- conf/catalina.policy.orig	2022-11-04 16:17:41.227506990 +0800
++++ conf/catalina.policy	2022-11-04 16:21:51.393351415 +0800
+@@ -56,6 +56,15 @@ grant codeBase "file:${java.home}/lib/ex
  //        permission java.security.AllPermission;
  //};
  
@@ -13,11 +13,10 @@
 +grant codeBase "file:/usr/share/java/ecj/ecj.jar" {
 +        permission java.security.AllPermission;
 +};
-+
  
  // ========== CATALINA CODE PERMISSIONS =======================================
  
-@@ -262,4 +272,4 @@ grant codeBase "file:${catalina.home}/we
+@@ -261,4 +270,4 @@ grant codeBase "file:${catalina.home}/we
  //
  // The permissions granted to a specific JAR
  // grant codeBase "war:file:${catalina.base}/webapps/examples.war*/WEB-INF/lib/foo.jar" {

tomcat-9.0-osgi-annotations.patch

@@ -0,0 +1,66 @@
+--- build.properties.default.orig       2022-06-21 20:30:04.498997718 +0800
++++ build.properties.default    2022-06-21 20:30:57.579522800 +0800
+@@ -309,6 +309,16 @@ bnd.home=${base.path}/bnd-${bnd.version}
+ bnd.jar=${bnd.home}/biz.aQute.bnd-${bnd.version}.jar
+ bnd.loc=${base-maven.loc}/biz/aQute/bnd/biz.aQute.bnd/${bnd.version}/biz.aQute.bnd-${bnd.version}.jar
+
++# ----- OSGi annotations bundle, version 1.0.0 or later            -----
++# ----- required to avoid Javadoc error when using bnd annotations -----
++osgi-annotations.version=1.1.1
++osgi-annotations.checksum.enabled=true
++osgi-annotations.checksum.algorithm=MD5|SHA-1
++osgi-annotations.checksum.value=04e5db48a469cb53dd0e4e954deab2e0|a1644f3dbbb614f2a44671d27dd13c4d9142007d
++osgi-annotations.home=${base.path}/osgi-annotations-${osgi-annotations.version}
++osgi-annotations.jar=${osgi-annotations.home}/org.osgi.annotation.bundle-${osgi-annotations.version}.jar
++osgi-annotations.loc=${base-maven.loc}/org/osgi/org.osgi.annotation.bundle/${osgi-annotations.version}/org.osgi.annotation.bundle-${osgi-annotations.version}.jar
++
+ # ----- JSign, version 4.1 or later -----
+ jsign.version=4.2
+
+--- build.xml.orig	2022-06-21 20:36:12.785560093 +0800
++++ build.xml	2022-06-21 20:40:41.155154959 +0800
+@@ -213,6 +213,7 @@
+   <!-- Classpaths -->
+   <path id="compile.classpath">
+     <pathelement location="${bnd.jar}"/>
++    <pathelement location="${osgi-annotations.jar}"/>
+     <pathelement location="${jdt.jar}"/>
+     <pathelement location="${jaxrpc-lib.jar}"/>
+     <pathelement location="${wsdl4j-lib.jar}"/>
+@@ -2270,7 +2271,8 @@ Apache Tomcat ${version} native binaries
+       failonwarning="true">
+       <classpath>
+         <path refid="compile.classpath"/>
+-        <path location="${ant.core.lib}"/>
++	<path location="${ant.core.lib}"/>
++	<path location="${osgi-annotations.jar}"/>
+       </classpath>
+       <link href="../annotationapi"/>
+       <link href="../servletapi"/>
+@@ -3671,12 +3673,26 @@ Read the Building page on the Apache Tom
+       <param name="checksum.algorithm" value="${bnd.checksum.algorithm}"/>
+       <param name="checksum.value" value="${bnd.checksum.value}"/>
+     </antcall>
++    <!-- Download OSGi annotations -->
++    <antcall target="downloadfile">
++      <param name="sourcefile" value="${osgi-annotations.loc}"/>
++      <param name="destfile" value="${osgi-annotations.jar}"/>
++      <param name="destdir" value="${osgi-annotations.home}"/>
++      <param name="checksum.enabled" value="${osgi-annotations.checksum.enabled}"/>
++      <param name="checksum.algorithm" value="${osgi-annotations.checksum.algorithm}"/>
++      <param name="checksum.value" value="${osgi-annotations.checksum.value}"/>
++    </antcall>
+   </target>
+ 
+   <target name="setup-bnd" depends="download-bnd">
+     <!-- Add bnd tasks to project -->
+     <path id="bnd.classpath">
+       <fileset file="${bnd.jar}" />
++      <fileset file="${bndlib.jar}" />
++      <fileset file="${bndlibg.jar}" />
++      <fileset file="${bndannotation.jar}" />
++      <fileset file="${slf4j-api.jar}" />
++      <fileset file="${osgi-cmpn.jar}" />
+     </path>
+ 
+     <taskdef resource="aQute/bnd/ant/taskdef.properties" classpathref="bnd.classpath" />

tomcat-9.0-tomcat-users-webapp.patch

@@ -1,6 +1,6 @@
 --- conf/tomcat-users.xml~	2008-01-28 17:41:06.000000000 -0500
 +++ conf/tomcat-users.xml	2008-03-07 19:40:07.000000000 -0500
-@@ -23,4 +23,14 @@
+@@ -53,4 +53,14 @@
    <user username="both" password="<must-be-changed>" roles="tomcat,role1"/>
    <user username="role1" password="<must-be-changed>" roles="role1"/>
  -->

tomcat-build.patch

@@ -1,18 +1,3 @@
-diff -up ./build.xml.orig ./build.xml
---- ./build.xml.orig	2020-07-13 12:59:09.555368724 -0400
-+++ ./build.xml	2020-07-13 13:06:51.246135917 -0400
-@@ -3307,6 +3307,11 @@ Read the Building page on the Apache Tom
-     <!-- Add bnd tasks to project -->
-     <path id="bnd.classpath">
-       <fileset file="${bnd.jar}" />
-+      <fileset file="${bndlib.jar}" />
-+      <fileset file="${bndlibg.jar}" />
-+      <fileset file="${bndannotation.jar}" />
-+      <fileset file="${slf4j-api.jar}" />
-+      <fileset file="${osgi-cmpn.jar}" />
-     </path>
- 
-     <taskdef resource="aQute/bnd/ant/taskdef.properties" classpathref="bnd.classpath" />
 diff -up ./res/bnd/build-defaults.bnd.orig ./res/bnd/build-defaults.bnd
 --- ./res/bnd/build-defaults.bnd.orig	2020-07-13 13:47:01.229077747 -0400
 +++ ./res/bnd/build-defaults.bnd	2020-07-13 13:47:12.923095618 -0400

tomcat.spec

@@ -31,7 +31,7 @@
 %global jspspec 2.3
 %global major_version 9
 %global minor_version 0
-%global micro_version 50
+%global micro_version 68
 %global packdname apache-tomcat-%{version}-src
 %global servletspec 4.0
 %global elspec 3.0
@@ -56,7 +56,7 @@
 Name:          tomcat
 Epoch:         1
 Version:       %{major_version}.%{minor_version}.%{micro_version}
-Release:       2%{?dist}
+Release:       1%{?dist}
 Summary:       Apache Servlet/JSP Engine, RI for Servlet %{servletspec}/JSP %{jspspec} API
 
 License:       ASL 2.0
@@ -73,6 +73,7 @@ Source21:      tomcat-functions
 Source30:      tomcat-preamble
 Source31:      tomcat-server
 Source32:      tomcat-named.service
+Source33:      java-9-start-up-parameters.conf
 
 Patch0:        %{name}-%{major_version}.%{minor_version}-bootstrap-MANIFEST.MF.patch
 Patch1:        %{name}-%{major_version}.%{minor_version}-tomcat-users-webapp.patch
@@ -80,6 +81,7 @@ Patch2:        %{name}-build.patch
 Patch3:        %{name}-%{major_version}.%{minor_version}-catalina-policy.patch
 Patch4:        rhbz-1857043.patch
 Patch5:        %{name}-%{major_version}.%{minor_version}-JDTCompiler.patch
+Patch6:        %{name}-%{major_version}.%{minor_version}-osgi-annotations.patch
 
 BuildArch:     noarch
 
@@ -190,6 +192,7 @@ find . -type f \( -name "*.bat" -o -name "*.class" -o -name Thumbs.db -o -name "
 %patch3 -p0
 %patch4 -p0
 %patch5 -p0
+%patch6 -p0
 
 # Remove webservices naming resources as it's generally unused
 %{__rm} -rf java/org/apache/naming/factory/webservices
@@ -302,6 +305,8 @@ popd
 %{__install} -m 0644 %{SOURCE32} \
     ${RPM_BUILD_ROOT}%{_unitdir}/%{name}@.service
 
+%{__install} -m 0644 %{SOURCE33} ${RPM_BUILD_ROOT}%{confdir}/conf.d/
+
 # Substitute libnames in catalina-tasks.xml
 sed -i \
    "s,el-api.jar,%{name}-el-%{elspec}-api.jar,;
@@ -441,6 +446,7 @@ fi
 %attr(0775,root,tomcat) %dir %{confdir}/Catalina/localhost
 %attr(0755,root,tomcat) %dir %{confdir}/conf.d
 %{confdir}/conf.d/README
+%{confdir}/conf.d/java-9-start-up-parameters.conf
 %config(noreplace) %{confdir}/%{name}.conf
 %config(noreplace) %{confdir}/*.policy
 %config(noreplace) %{confdir}/*.properties
@@ -496,20 +502,61 @@ fi
 %{appdir}/ROOT
 
 %changelog
+* Thu Nov 03 2033 Hui Wang <huwang@redhat.com> - 1:9.0.68-1
+- Update to 9.0.68
+
+* Thu Jul 21 2022 Hui Wang <huwang@redhat.com> - 1:9.0.65-1
+- Update to 9.0.65
+
+* Tue Jun 21 2022 Hui Wang <huwang@redhat.com> - 1:9.0.64-1
+- Update to 9.0.64
+- Add osgi-annotations dependency back
+
+* Thu Mar 10 2022 Coty Sutherland <csutherl@redhat.com> - 1:9.0.59-3
+- Related: rhbz#2061424 Adjust fix so that it uses the proper env var
+
+* Tue Mar 08 2022 Coty Sutherland <csutherl@redhat.com> - 1:9.0.59-2
+- Resolves: rhbz#2061424 Add Java 9 start-up parameters to allow reflection
+
+* Wed Mar 02 2022 Sonia Xu <sonix@amazon.com> - 1:9.0.59-1
+- Update to 9.0.59
+- Resolves: rhbz#2047419 - CVE-2022-23181 tomcat: local privilege escalation vulnerability
+
+* Sat Feb 05 2022 Jiri Vanek <jvanek@redhat.com> - 1:9.0.56-3
+- Rebuilt for java-17-openjdk as system jdk
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1:9.0.56-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Thu Dec 09 2021 Hui Wang <huwang@redhat.com> - 1:9.0.56-1
+- Update to 9.0.56
+
+* Tue Oct 12 2021 Hui Wang <huwang@redhat.com> - 1:9.0.55-1
+- Update to 9.0.55
+
+* Tue Oct 12 2021 Hui Wang <huwang@redhat.com> - 1:9.0.54-1
+- Update to 9.0.54
+
+* Thu Sep 16 2021 Hui Wang <huwang@redhat.com> - 1:9.0.53-1
+- Update to 9.0.53
+
+* Wed Aug 18 2021 Hui Wang <huwang@redhat.com> - 1:9.0.52-1
+- Update to 9.0.52
+
 * Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1:9.0.50-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
 
-* Tue Jul 06 2021 Hui Wang <huwang@redhat.com> 1:9.0.50-1
+* Tue Jul 06 2021 Hui Wang <huwang@redhat.com> - 1:9.0.50-1
 - Update to 9.0.50
 
-* Sat Jun 05 2021 Coty Sutherland <csutherl@redhat.com> 1:9.0.45-4
+* Sat Jun 05 2021 Coty Sutherland <csutherl@redhat.com> - 1:9.0.45-4
 - Add back logrotate config file per devel list request
 - Add mvn virtual provides back for the servlet, el, and jsp spec impls
 
-* Fri Jun 04 2021 Coty Sutherland <csutherl@redhat.com> 1:9.0.45-3
+* Fri Jun 04 2021 Coty Sutherland <csutherl@redhat.com> - 1:9.0.45-3
 - Drop geronimo-jaxrpc, which provided the webservices naming factory resources that are generally unused
 
-* Thu Jun 03 2021 Coty Sutherland <csutherl@redhat.com> 1:9.0.45-2
+* Thu Jun 03 2021 Coty Sutherland <csutherl@redhat.com> - 1:9.0.45-2
 - Remove examples webapps from subpackage
 - Updates to javapackages-local removed %%add_maven_depmap which broke the build,
   so I removed the maven artifacts as they aren't very useful anyway