Description of the patch:
This update for tomcat11 fixes the following issues
Update to Tomcat 11.0.23.
Security issues fixed:
- CVE-2026-50229: improper neutralization of script-related HTML tags in the number guess example (bsc#1269791).
- CVE-2026-53404: always-incorrect control flow implementation in the rewrite valve caused non-OR conditions to be
skipped if the first condition in an OR chain matched (bsc#1269910).
- CVE-2026-53434: error condition not handled when configuring CRLs for a FFM based connector (bsc#1269824).
- CVE-2026-55276: always-incorrect control flow implementation caused special roles and empty authorization constraints
to not be included when the effective web.xml was logged (bsc#1269909).
- CVE-2026-55955: improper authentication allows a replay attack against the EncryptionInterceptor in the cluster
component (bsc#1269908).
- CVE-2026-55956: improper authorization leads to security constraints specified for the default servlet ignoring any
method or method omission configured as part of the constraint (bsc#1269907).
Other updates and bugfixes:
- Upgrade libtcnative to v2 (bsc#1232390)
- Tomcat 11.0.23:
- Catalina
- Add: Add support for literal '%' characters in access log output. Based on
pull request #1002 by Fabian Hahn. (markt)
- Fix: Lower the log level to debug when OpenSSL initialization fails in
OpenSSLLifecycleListener to avoid stack traces when libssl.so is not
present and to align the behavior of the isAvailable() check with the
AprLifecycleListener and gracefully fail when natives are not present.
(csutherl)
- Fix: 70038: Cookie.clone() should also clone the internal attribute map.
(markt)
- Code: Remove unnecessary code from the SSI processing engine that was
duplicating some of the normalisation checks. (markt)
- Fix: Cleaner handling of invalid SPNEGO tokens. (remm)
- Fix: Avoid some NPEs in the Connector class on an uninitialize protocol....