[Bug 1915911] Re: Tomcat9 package is old version with many security issues

[Paulo Flabiano Smorigo]

Hello Evren, thanks for the debdiff. I'm using it to build the new
release for Focal. I did some checks today and will continue on Monday.
If all goes well I think we can have a new package in the archive next
week. Meanwhile, I'm working on the bionic version.

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1915911

Title:
  Tomcat9 package is old version with many security issues

Status in tomcat9 package in Ubuntu:
  Confirmed

Bug description:
  Tomcat9 package is based on 9.0.16 on bionic and 9.0.31 on focal.

  Several "Important" security vulnerabilities has been found since those versions:
  https://tomcat.apache.org/security-9.html

  ```
  Important

  A vulnerability rated as Important impact is one which could result in the compromise of data or availability of the server. For Tomcat this includes issues that allow an easy remote denial of service (something that is out of proportion to the attack or with a lasting consequence), access to arbitrary files outside of the context root, or access to files that should be otherwise prevented by limits or authentication.
  ```

  These packages should be updated to use at least Tomcat 9.0.40. Can
  you please provide the update?

  Thanks!

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tomcat9/+bug/1915911/+subscriptions