0

As we are using apache tomcat server version 6.0.28.

[Problem Statement] While using tomcat version (6.0.28),we have faced few security vulnerability issues in this version(6.0.28).

Below are the issues list:

  1. CVE-2012-2733,CVE-2012-5887,CVE-2012-5885,CVE-2012-5886
  2. CVE-2011-3375
  3. CVE-2011-4858,CVE-2012-0022
  4. CVE-2011-5063,CVE-2011-5064,CVE-2011-1184,CVE-2011-5062
  5. CVE-2011-2204,CVE-2011-2526,CVE-2011-2481,CVE-2011-2729
  6. CVE-2011-0013,CVE-2010-4172
  7. CVE-2010-3718

We want to continue using this version(6.0.28) and want to merge those fixes(security vulnerability issue) to 6.0.28. So what is best and easiest way to make these changes?

0

1 Answer 1

0

The simplest way is to drop the requirement to remain on 6.0.28 with patches and simply download the latest 6.0.x release from the ASF.

If you insist on continuing down this path (and I strongly recommend that you don't) then you'll need to do the following:

  • Checkout the 6.0.28 tag
  • Apply each of the patches listed for each of the security vulnerabilities quoted above
  • Resolve any conflicts
  • Build the resulting source tree

The command to checkout the 6.0.28 source is

svn co https://svn.apache.org/repos/asf/tomcat/tc6.0.x/tags/TOMCAT_6_0_28

cd TOMCAT_6_0_28

Then you will need to apply each of the patches listed on the Tomcat 6 security page for the vulnerabilities you want to address.

svn merge -c nnnnnnn https://svn.apache.org/repos/asf/tomcat/tc6.0.x/trunk

Some of these patches will apply cleanly. Others will depend on previous non-security changes since 6.0.28 and will, therefore, generate conflicts which you will need to resolve manually.

Once you have applied all the patches, simply following the Tomact 6 building instructions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .