geronimo-tomcat6-jee5-2.2-1.AXS3

The goal of the Geronimo project is to produce a server runtime framework that pulls together the best Open Source alternatives to create runtimes that meet the needs of developers and system administrators.
Security issues fixed with this release:
CVE-2007-4548:
The login method in LoginModule implementations in Apache Geronimo 2.0 does not throw FailedLoginException for failed logins, which allows remote attackers to bypass authentication requirements, deploy arbitrary modules, and gain administrative access by sending a blank username and password with the command line deployer in the deployment module.
CVE-2007-5085:
Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimobefore 2.0.2 allows remote attackers to bypass authentication and obtainaccess to Geronimo internals via unspecified vectors.
CVE-2007-5797:
SQLLoginModule in Apache Geronimo 2.0 through 2.1 does not throw an exception for a nonexistent username, which allows remote attackers to bypass authentication via a login attempt with any username not contained in the database.