You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@tomee.apache.org by "Jonathan Gallimore (Jira)" <ji...@apache.org> on 2024/10/17 08:28:00 UTC

[jira] [Assigned] (TOMEE-4419) TomEE Plus 9.1.3 shipping EOL Tomcat 10.0.27

     [ https://issues.apache.org/jira/browse/TOMEE-4419?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jonathan Gallimore reassigned TOMEE-4419:
-----------------------------------------

    Assignee: Jonathan Gallimore

> TomEE Plus 9.1.3 shipping EOL Tomcat 10.0.27
> --------------------------------------------
>
>                 Key: TOMEE-4419
>                 URL: https://issues.apache.org/jira/browse/TOMEE-4419
>             Project: TomEE
>          Issue Type: Dependency upgrade
>          Components: TomEE Build
>    Affects Versions: 9.1.3
>            Reporter: Arin Sukhwal
>            Assignee: Jonathan Gallimore
>            Priority: Critical
>              Labels: TomEE, tomcat
>
> We have identified that Apache TomEE Plus 9.1.3 is shipping with Tomcat version 10.0.27, which has reached End of Life (EOL) status. From our  research, it appears that new vulnerabilities are not tested against the 10.0.x branch of Tomcat.
> The stable version of TomEE Plus is currently 9.1.3, while the 10.x version of TomEE Plus is still a milestone release that we can not deploy in production.
> The bundled Tomcat version is outdated and vulnerable, and updating it separately is not possible. Could someone explain why an outdated Tomcat version (10.0.27) is being shipped with TomEE Plus 9.1.3, and is there any potential resolution to ensure the system remains secure?
> *Expected Result:*
> TomEE Plus should include a supported, non-EOL version of Tomcat that is tested against recent vulnerabilities.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)