Issue summary

Apache Tomcat should be upgraded to 8.5.88 and 9.0.74 or a later version to fix CVE-2023-28709

Environment

• Bamboo 8, 9

Steps to Reproduce

• Check the Apache Tomcat version on pom.xml or <bamboo-install>/bin/version.sh/bat

Expected Results

• Bamboo 8.x: apache-tomcat 8.5.88 and later
• Bamboo 9.x: apache-tomcat 9.0.74 and later

Actual Results

• Bamboo 8.x: apache-tomcat 8.5.87 and earlier
• Bamboo 9.x: apache-tomcat-9.0.73 and earlier

Workaround

At your own risk, you can manually upgrade Tomcat as instructed on this KB:

• How to upgrade Apache Tomcat version used by Bamboo

WARNING: Unless still reproducible on official releases, Atlassian Support may refuse support requests for Bamboo running over unofficial Tomcat versions.