Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-59887

Upgrade Tomcat to the latest 8.0.x release

XMLWordPrintable

      Summary

      We are currently on 8.0.17 and have already been bitten by a bug in it:

      https://bz.apache.org/bugzilla/show_bug.cgi?id=57476

      We should upgrade to the latest to get the latest bugfixes.

      Also, there have been a number of recent CVEs involving Tomcat, most of which involve SecurityManager, which I believe we do not currently use.

      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5174
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0706
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0714
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0763

      However, these are related to other aspects of Tomcat:

      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5345
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5346
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5351 (probably doesn't affect us)

      Updating Tomcat to one of these versions would appear to patch all of the above CVEs:

      • Apache Tomcat 9.0.0.M3
      • Apache Tomcat 8.0.32
      • Apache Tomcat 7.0.68
      • Apache Tomcat 6.0.45

            [JRASERVER-59887] Upgrade Tomcat to the latest 8.0.x release

            Dieter Greiner added a comment -

            Why is still "soaking" after JIRA 7.1.7 has been released today?

            Dieter Greiner added a comment - Why is still "soaking" after JIRA 7.1.7 has been released today?

            Pawel Farid (Inactive) added a comment -

            ohernandez@atlassian.com hey Os any progress here ?

            Pawel Farid (Inactive) added a comment - ohernandez@atlassian.com hey Os any progress here ?

            MichaelL added a comment -

            There are numerous bug fixes and SSL (Coyote) updates within Apache Tomcat 8 since version 8.0.17. see http://tomcat.apache.org/tomcat-8.0-doc/changelog.html.

            A fresher version of Tomcat 8 in the Atlassian installers would make it easier for admins configure SSL using optimal protocols and cipher suites.

            MichaelL added a comment - There are numerous bug fixes and SSL (Coyote) updates within Apache Tomcat 8 since version 8.0.17. see http://tomcat.apache.org/tomcat-8.0-doc/changelog.html . A fresher version of Tomcat 8 in the Atlassian installers would make it easier for admins configure SSL using optimal protocols and cipher suites.

              pbugalski Pawel Bugalski (Inactive)
              ohernandez@atlassian.com Oswaldo Hernandez (Inactive)
              Affected customers:
              4 This affects my team
              Watchers:
              11 Start watching this issue

                Created:
                Updated:
                Resolved: