Should there be any question about backporting?
Sure, I can distribute a patched Glassfish to everyone to use with the application in question, but that seems rather onerous given the safe nature of the fix.
[Message sent by forum member 'jess_holle' (jess_holle)]
http://forums.java.net/jive/thread.jspa?messageID=241786