[jira] [Commented] (TOMEE-4419) TomEE Plus 9.1.3 shipping EOL Tomcat 10.0.27

["Jonathan Gallimore (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/TOMEE-4419?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17890368#comment-17890368 ] 

Jonathan Gallimore commented on TOMEE-4419:
-------------------------------------------

TomEE 9.x targets Jakarta EE 9. The corresponding version of Tomcat that targets Jakarta EE 9 is Tomcat 10.0.x. Later Tomcat branches of Tomcat, for example, Tomcat 10.1.x, target Servlet 6.0, which is part of Jakarta EE 10, so updating to 10.1.x isn't an option for TomEE 9.

 

The TomEE community does, however, backport Tomcat fixes for Tomcat 10.0.x where possible: [https://github.com/apache/tomee/tree/tomee-9.x/tomee/apache-tomee/src/patch/java/org/apache]

 

Participation in maintaining those fixes for TomEE 9, or development of TomEE 10 is most welcome.

> TomEE Plus 9.1.3 shipping EOL Tomcat 10.0.27
> --------------------------------------------
>
>                 Key: TOMEE-4419
>                 URL: https://issues.apache.org/jira/browse/TOMEE-4419
>             Project: TomEE
>          Issue Type: Dependency upgrade
>          Components: TomEE Build
>    Affects Versions: 9.1.3
>            Reporter: Arin Sukhwal
>            Priority: Critical
>              Labels: TomEE, tomcat
>
> We have identified that Apache TomEE Plus 9.1.3 is shipping with Tomcat version 10.0.27, which has reached End of Life (EOL) status. From our  research, it appears that new vulnerabilities are not tested against the 10.0.x branch of Tomcat.
> The stable version of TomEE Plus is currently 9.1.3, while the 10.x version of TomEE Plus is still a milestone release that we can not deploy in production.
> The bundled Tomcat version is outdated and vulnerable, and updating it separately is not possible. Could someone explain why an outdated Tomcat version (10.0.27) is being shipped with TomEE Plus 9.1.3, and is there any potential resolution to ensure the system remains secure?
> *Expected Result:*
> TomEE Plus should include a supported, non-EOL version of Tomcat that is tested against recent vulnerabilities.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)