Hi Andreas, Am 05.03.20 um 09:34 schrieb Andreas Tille: > Hi, > > I was wondering, whether there is a chance to get CVE-2020-1938 fixed in > Tomcat8 in Stretch? If the chances are low possibly backporting Tomcat9 > to stretch-backports-sloppy would be a feasible way to go for me. What > would you recomment? I intend to fix tomcat8 in Stretch soon. I hope to fix tomcat9 in Buster too but wouldn't mind if someone beat me to it. Please note that the AJP connector is disabled by default in Debian and one may argue that only those users who use it with untrusted services (not recommended) are really affected. The fix might require some minor updates to your configuration. Regards, Markus
Attachment:
signature.asc
Description: OpenPGP digital signature