Mageia 2 is also affected.
tomcat (tomcat7) 7.0.32 is in Cauldron, so that one is OK there.
This fixes CVE-2012-2733, as well as three that the upstream security pages fail to mention.  According to the CVE entries, they are fixed upstream in 5.5.36, 6.0.36, and 7.0.30.  They are CVE-2012-5885, CVE-2012-5886, and CVE-2012-5887.
This references the ones listed upstream as fixed in tomcat7.
I added apache-mod_antiloris to mandriva contrib in 2009 to mitigate slowloris. It could be worthwhile importing it to Mageia I guess.
tomcat6-6.0.36-1.mga3 and tomcat5-5.5.31-9.mga3 builds fine for me (mga2), but not in cauldron. I hope someone can look at that.
Thanks D Morgan!  Assigning to QA.
Advisory to come later (any help with that is welcome).
This should be simple to test..
Not sure the directory name to put this, it could be tomcat7/webapps or just tomcat/webapps. This is the first update for tomcat7. Whichever exists.
"Core Release" and "Core Updates Testing".
OK, here are the advisories.
We haven't addressed CVE-2012-5568, so we'll need a new bug for that one.
restrictions by sniffing the network for valid requests (CVE-2012-5885).
lacks a session identifier (CVE-2012-4431).
It seems tomcat comes with the sample and examples now so no need to download anything.
Edit /etc/tomcat/tomcat-users.xml and uncomment the users, adding manager-gui role to one of them.
Browse http://localhost:8080/sample and http://localhost:8080/examples and click the links.
Also browse http://localhost:8080 and log into the 'manager app' with the credentials just configured with manager-gui role.
Installs tomcat6-jsp-2.1-api & tomcat6-servlet-2.5-api from Updates. I seem to remember this was a workaround from a previous update.
It does install tomcat5 jsp & servlet packages but still installs tomcat6 packages if installed from fresh.
Also still the permissions error.
No write perms for group, the directory is empty.
Installs the two tomcat6 packages from updates testing aswell as the tomcat5 equivalents and has the same permissions problem.
We've had permission problems with tomcat in the past too.
We could split the bug if it's difficult to fix.
Previous was bug 3099 on mga1 where there was a permissions issue with a different directory. If there is no fix it could maybe be resolved in the same way.
Should we split this bug to allow tomcat 6 & 7 to be pushed?
Bug 8692 filed for tomcat6 and tomcat (tomcat7).
Please use this bug for tomcat5 only now. Thanks!
Assigning dmorgan, please reassign to QA when you've had a chance to look at this.
Struts is an extra 208 packages, is it necessary too?
Starting tomcat5 (via systemctl):  Job failed. See system journal and 'systemctl status' for details.
systemd: Unit tomcat5.service entered failed state.
Closing this now due to Mageia 2 EOL.