Description of the patch:
This update for tomcat fixes the following issues:
Update to Tomcat 9.0.120.
Security issues fixed:
- CVE-2026-59083: incorrect URL decoding in
RewriteValve may allow security control bypass (bsc#1271397).
- CVE-2026-59084:
EncryptInterceptor requirements are not clearly documented (bsc#1271398).
Other updates and bugfixes:
- Tomcat 9.0.120:
- Catalina
- Fix: Avoid a race condition with concurrent lookups for a singleton JNDI
resource. (markt)
- Fix: Improve the performance of range validation for the default
servlet. (markt)
- Fix: Avoid NPE in RewriteValve. (markt)
- Fix: 70127: Fix use of Bootstrap through reflection by restoring the
public constructor. Use through scripts was not affected. (remm)
- Fix: Restore ability to extend many element classes from
AbstractAccessLogValve. (remm)
- Fix: Align DIGEST authentication with RFC 7616 and require clients to
provide a valid qop parameter. (markt)
- Fix: Use Files API to create temporary docBase when antiLockingDocBase
is enabled. (markt)
- Fix: Improve validation of configuration when DataSourceRealm starts.
(remm)
- Fix: JAASRealm should do a logout if login does not fail outright but
does not produce a Principal. (remm)
- Fix: Various edge cases for SSI substitutions, quoting and escaping.
- Fix: unintentional conversion of literal + to a space during rule
processing in the RewriteValve. (markt)
- Coyote
- Fix: Avoid a potential JVM crash if a suitable version of Tomcat Native
is not available when the connector is explicitly configured to use
Tomcat Native with OpenSSL for TLS. (markt)
- Fix: Correct a regression introduced in 9.0.119 that broke reading of
some request bodies via a Reader. (markt)
- Jasper
- Fix: 70120: The fix for 69399 (itself a fix for a regression in the fix
for 69333) was incomplete and tags that threw exceptions in...