Description: Fixes CVE-2016-0706: Apache Tomcat does not place StatusManagerServlet
 on the RestrictedServlets.properties list, which allows remote authenticated
 users to bypass intended SecurityManager restrictions  and read arbitrary HTTP
 requests, and consequently discover session ID  values, via a crafted web
 application.
Author: Markus Koschany <apo@debian.org>
Origin: backport, https://svn.apache.org/r1722800
--- a/java/org/apache/catalina/core/RestrictedServlets.properties
+++ b/java/org/apache/catalina/core/RestrictedServlets.properties
@@ -16,3 +16,4 @@
 org.apache.catalina.ssi.SSIServlet=restricted
 org.apache.catalina.servlets.CGIServlet=restricted
 org.apache.catalina.manager.JMXProxyServlet=restricted
+org.apache.catalina.manager.StatusManagerServlet=restricted
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -348,6 +348,10 @@
         Don't create sessions unnecessarily in the Host Manager application.
         (markt)
       </fix>
+      <fix>
+        Add the <code>StatusManagerServlet</code> to the list of Servlets that
+        can only be loaded by privileged applications. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="WebSocket">
