File tomcat-8.0.53-CVE-2019-12418.patch of Package tomcat.30738

Overview Repositories Revisions Requests Users Attributes Meta

File tomcat-8.0.53-CVE-2019-12418.patch of Package tomcat.30738

From bef3f40400243348d12f4abfe9b413f43897c02b Mon Sep 17 00:00:00 2001
From: remm <remm@apache.org>
Date: Thu, 14 Nov 2019 13:42:28 +0100
Subject: [PATCH] Refactor JMX remote RMI registry creation

---
 .../mbeans/JmxRemoteLifecycleListener.java    | 67 +++++++++++++------
 webapps/docs/changelog.xml                    |  3 +
 2 files changed, 51 insertions(+), 19 deletions(-)

Index: java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java
===================================================================
--- java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java.orig
+++ java/org/apache/catalina/mbeans/JmxRemoteLifecycleListener.java
@@ -25,10 +25,11 @@ import java.net.MalformedURLException;
 import java.net.ServerSocket;
 import java.net.Socket;
 import java.net.UnknownHostException;
+import java.rmi.AccessException;
 import java.rmi.AlreadyBoundException;
+import java.rmi.NotBoundException;
+import java.rmi.Remote;
 import java.rmi.RemoteException;
-import java.rmi.registry.LocateRegistry;
-import java.rmi.registry.Registry;
 import java.rmi.server.RMIClientSocketFactory;
 import java.rmi.server.RMIServerSocketFactory;
 import java.security.NoSuchAlgorithmException;
@@ -300,18 +301,6 @@ public class JmxRemoteLifecycleListener
             RMIClientSocketFactory registryCsf, RMIServerSocketFactory registrySsf,
             RMIClientSocketFactory serverCsf, RMIServerSocketFactory serverSsf) {
 
-        // Create the RMI registry
-        Registry registry;
-        try {
-            registry = LocateRegistry.createRegistry(
-                    theRmiRegistryPort, registryCsf, registrySsf);
-        } catch (RemoteException e) {
-            log.error(sm.getString(
-                    "jmxRemoteLifecycleListener.createRegistryFailed",
-                    serverName, Integer.toString(theRmiRegistryPort)), e);
-            return null;
-        }
-
         if (bindAddress == null) {
             bindAddress = "localhost";
         }
@@ -332,11 +321,20 @@ public class JmxRemoteLifecycleListener
             cs = new RMIConnectorServer(serviceUrl, theEnv, server,
                     ManagementFactory.getPlatformMBeanServer());
             cs.start();
-            registry.bind("jmxrmi", server.toStub());
+            Remote jmxServer = server.toStub();
+            // Create the RMI registry
+            try {
+                new JmxRegistry(theRmiRegistryPort, registryCsf, registrySsf, "jmxrmi", jmxServer);
+            } catch (RemoteException e) {
+                log.error(sm.getString(
+                        "jmxRemoteLifecycleListener.createRegistryFailed",
+                        serverName, Integer.toString(theRmiRegistryPort)), e);
+                return null;
+            }
             log.info(sm.getString("jmxRemoteLifecycleListener.start",
                     Integer.toString(theRmiRegistryPort),
                     Integer.toString(theRmiServerPort), serverName));
-        } catch (IOException | AlreadyBoundException e) {
+        } catch (IOException e) {
             log.error(sm.getString(
                     "jmxRemoteLifecycleListener.createServerFailed",
                     serverName), e);
@@ -465,4 +463,38 @@ public class JmxRemoteLifecycleListener
             return sslServerSocket;
         }
     }
+
+   private static class JmxRegistry extends sun.rmi.registry.RegistryImpl {
+       private static final long serialVersionUID = -3772054804656428217L;
+       private final String jmxName;
+       private final Remote jmxServer;
+       public JmxRegistry(int port, RMIClientSocketFactory csf,
+               RMIServerSocketFactory ssf, String jmxName, Remote jmxServer) throws RemoteException {
+           super(port, csf, ssf);
+           this.jmxName = jmxName;
+           this.jmxServer = jmxServer;
+       }
+       @Override
+       public Remote lookup(String name)
+               throws RemoteException, NotBoundException {
+           return (jmxName.equals(name)) ? jmxServer : null;
+       }
+       @Override
+       public void bind(String name, Remote obj)
+               throws RemoteException, AlreadyBoundException, AccessException {
+       }
+       @Override
+       public void unbind(String name)
+               throws RemoteException, NotBoundException, AccessException {
+       }
+       @Override
+       public void rebind(String name, Remote obj)
+               throws RemoteException, AccessException {
+       }
+       @Override
+       public String[] list() throws RemoteException {
+           return new String[] { jmxName };
+       }
+   }
+
 }

Places

File tomcat-8.0.53-CVE-2019-12418.patch of Package tomcat.30738

Places