Merge ~levihackerman-102/ubuntu/+source/tomcat10:merge-lp2131133-resolute into ubuntu/+source/tomcat10:debian/sid

[Anshul Singh]

[Anshul Singh (levihackerman-102)]

Here's the passing ppa build:

https://launchpad.net/~levihackerman-102/+archive/ubuntu/merges/+build/31482097

[Nick Rosbrook (enr0n)]

See inline comments. I don't think this needs a merge at all, and should be a sync, but please address my comments to be sure.

review: Needs Fixing

Unmerged commits

5871f3e... by Anshul Singh on 2025-11-12

update maintainer

a3fe025... by Anshul Singh on 2025-11-12

changelog: Merge of 10.1.46-1

22b924d... by Anshul Singh on 2025-11-12

refreshed patch

1c7b5f8... by Anshul Singh on 2025-11-12

* SECURITY UPDATE: Security Constraint Bypass
    - debian/patches/CVE-2025-46701.patch: Refactor CGI servlet to
      access resources via WebResources
    - CVE-2025-46701

diff --git a/debian/changelog b/debian/changelog
index 2954234..52d8366 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+tomcat10 (10.1.46-1ubuntu1) resolute; urgency=medium
+
+  * Remaining changes:
+    - SECURITY UPDATE: Security Constraint Bypass
+      - debian/patches/CVE-2025-46701.patch: Refactor CGI servlet to
+      access resources via WebResources
+      - CVE-2025-46701
+
+ -- Anshul Singh <[e-mail]>  Wed, 12 Nov 2025 08:27:52 +0000
+
 tomcat10 (10.1.46-1) unstable; urgency=medium
 
   * New upstream release
@@ -5,6 +15,15 @@ tomcat10 (10.1.46-1) unstable; urgency=medium
 
  -- Emmanuel Bourg <[e-mail]>  Mon, 29 Sep 2025 13:43:22 +0200
 
+tomcat10 (10.1.40-1ubuntu1) questing; urgency=medium
+
+  * SECURITY UPDATE: Security Constraint Bypass
+    - debian/patches/CVE-2025-46701.patch: Refactor CGI servlet to
+      access resources via WebResources
+    - CVE-2025-46701
+
+ -- Bruce Cable <[e-mail]>  Fri, 20 Jun 2025 14:15:00 +1000
+
 tomcat10 (10.1.40-1) unstable; urgency=medium
 
   * New upstream release
diff --git a/debian/control b/debian/control
index f6c40b6..e7d5506 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: tomcat10
 Section: java
 Priority: optional
-Maintainer: Debian Java Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Java Maintainers <[e-mail]>
 Uploaders:
  tony mancill <[e-mail]>,
  Emmanuel Bourg <[e-mail]>,
diff --git a/debian/patches/CVE-2025-46701.patch b/debian/patches/CVE-2025-46701.patch
new file mode 100644
index 0000000..beb59cc
--- /dev/null
+++ b/debian/patches/CVE-2025-46701.patch
@@ -0,0 +1,26 @@
+From 2c6800111e7d8d8d5403c07978ea9bff3db5a5a5 Mon Sep 17 00:00:00 2001
+From: Mark Thomas <[e-mail]>
+Date: Mon, 28 Apr 2025 12:58:21 +0100
+Subject: [PATCH] Refactor CGI servlet to access resources via WebResources
+
+---
+ .../apache/catalina/servlets/CGIServlet.java  | 233 +++++++-----------
+ .../catalina/servlets/LocalStrings.properties |   1 -
+ .../servlets/LocalStrings_fr.properties       |   1 -
+ .../servlets/LocalStrings_ja.properties       |   1 -
+ .../servlets/LocalStrings_ko.properties       |   1 -
+ .../servlets/LocalStrings_zh_CN.properties    |   1 -
+ webapps/docs/changelog.xml                    |   4 +
+ 7 files changed, 97 insertions(+), 145 deletions(-)
+
+--- a/java/org/apache/catalina/servlets/CGIServlet.java
++++ b/java/org/apache/catalina/servlets/CGIServlet.java
+@@ -24,6 +24,8 @@
+ import java.io.InputStreamReader;
+ import java.io.OutputStream;
+ import java.io.UnsupportedEncodingException;
++import java.net.MalformedURLException;
++import java.net.URL;
+ import java.net.URLDecoder;
+ import java.nio.file.Files;
+ import java.util.ArrayList;
diff --git a/debian/patches/series b/debian/patches/series
index e9a79e2..780f2de 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -13,3 +13,4 @@
 exclude-TestJNDIRealmIntegration.patch
 disable-jacoco.patch
 0030-eclipse-jdt-classpath.patch
+CVE-2025-46701.patch