Upgrade to Tomcat 8.5.40

[philwebb]

It fixes the regression discussed in #16486

[phil-schneider]

Not sure what is meant here:
but the 2.1.x branch contains already tomcat.version 9.0.17

https://github.com/spring-projects/spring-boot/blob/2.1.x/spring-boot-project/spring-boot-dependencies/pom.xml#L190

[snicoll]

Thats not the version referenced in this issue though.

[phil-schneider]

I think the milestone tag is wrong.
The issue/problem was reported in a 1.5.x version

[snicoll]

Ah, that. Yes it's indeed wrong.

[peter-janssen]

This also fixes CVE-2019-0232 according to the changelog. Shouldn't this (also) be on the 2.0.x milestone?

[wilkinsona]

Shouldn't this (also) be on the 2.0.x milestone?

We assign issues to the earliest milestone in which they will be fixed. Additional issues are then created as part of merging the change forward. That won't include 2.0.x as 2.0.9 was the final 2.0.x release. It also won't include 2.1.x as that line is using Tomcat 9.

[peter-janssen]

I'm a bit confused, what will become of this issue? Is it only going to be applied to 1.5.x?