You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@tomee.apache.org by "Arin Sukhwal (Jira)" <ji...@apache.org> on 2024/10/17 08:16:00 UTC

[jira] [Created] (TOMEE-4419) TomEE Plus 9.1.3 shipping EOL Tomcat 10.0.27

Arin Sukhwal created TOMEE-4419:
-----------------------------------

             Summary: TomEE Plus 9.1.3 shipping EOL Tomcat 10.0.27
                 Key: TOMEE-4419
                 URL: https://issues.apache.org/jira/browse/TOMEE-4419
             Project: TomEE
          Issue Type: Dependency upgrade
          Components: TomEE Build
    Affects Versions: 9.1.3
            Reporter: Arin Sukhwal


We have identified that Apache TomEE Plus 9.1.3 is shipping with Tomcat version 10.0.27, which has reached End of Life (EOL) status. From our  research, it appears that new vulnerabilities are not tested against the 10.0.x branch of Tomcat.


The stable version of TomEE Plus is currently 9.1.3, while the 10.x version of TomEE Plus is still a milestone release that we can not deploy in production.
The bundled Tomcat version is outdated and vulnerable, and updating it separately is not possible. Could someone explain why an outdated Tomcat version (10.0.27) is being shipped with TomEE Plus 9.1.3, and is there any potential resolution to ensure the system remains secure?


*Expected Result:*
TomEE Plus should include a supported, non-EOL version of Tomcat that is tested against recent vulnerabilities.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)