From 79505ef213d465389ec94c00d0065896d5a1ace0 Mon Sep 17 00:00:00 2001
From: Mark Thomas <markt@apache.org>
Date: Thu, 19 Sep 2024 06:25:24 -0600
Subject: [PATCH 1/2] If the Jakarta Authentication fails with an exception,
 set a 500 status

Depending on what fails where, the status may not be set or may be set
incorrectly.
---
 .../org/apache/catalina/authenticator/AuthenticatorBase.java | 2 ++
 webapps/docs/changelog.xml                                   | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/java/org/apache/catalina/authenticator/AuthenticatorBase.java b/java/org/apache/catalina/authenticator/AuthenticatorBase.java
index 8bd74438e8a0..6b592d6f83cc 100644
--- a/java/org/apache/catalina/authenticator/AuthenticatorBase.java
+++ b/java/org/apache/catalina/authenticator/AuthenticatorBase.java
@@ -884,6 +884,8 @@ private boolean authenticateJaspic(Request request, Response response, JaspicSta
             authStatus = state.serverAuthContext.validateRequest(state.messageInfo, client, null);
         } catch (AuthException e) {
             log.debug(sm.getString("authenticator.loginFail"), e);
+            // Need to explicitly set the return code as the ServerAuthContext may not have done.
+            response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
             return false;
         }
 
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index e3d355cad92e..32c68c0468e3 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -178,6 +178,11 @@
         <code>JsonErrorReportValve</code> to ensure that it always outputs valid
         JSON. (markt)
       </fix>
+      <fix>
+        If the Jakarta Authentication process fails with an Exception,
+        explicitly set the HTTP response status to 500 as the
+        <code>ServerAuthContext</code> may not have set it. (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">

From a8441ce3863b06ab117a49aa44cafe776620856d Mon Sep 17 00:00:00 2001
From: Cesar Hernandez <cfhernan123@gmail.com>
Date: Wed, 20 Nov 2024 16:08:42 -0600
Subject: [PATCH 2/2] Backport 7532f9d to mitigate CVE-2024-52316 and updated
 version to 10.0.28-TT.11

---
 build.properties.default | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.properties.default b/build.properties.default
index 37884ec2490a..3d6a3964ee60 100644
--- a/build.properties.default
+++ b/build.properties.default
@@ -33,7 +33,7 @@ version.major=10
 version.minor=0
 version.build=28
 version.patch=0
-version.suffix=-TT.10
+version.suffix=-TT.11
 version.dev=
 
 # ----- Build tools -----