[Bug 1915911] Re: Tomcat9 package is old version with many security issues

[Evren Yurtesen]

Hi Paulo,
Thanks for looking into this and sorry that I forgot bionic actually. Did all go well?
I have some other small bugfixes for this package at #1964881 (although not security related and there are no code changes to source). I am not sure if you would like to combine them or not?
Thanks!

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1915911

Title:
  Tomcat9 package is old version with many security issues

Status in tomcat9 package in Ubuntu:
  Confirmed

Bug description:
  Tomcat9 package is based on 9.0.16 on bionic and 9.0.31 on focal.

  Several "Important" security vulnerabilities has been found since those versions:
  https://tomcat.apache.org/security-9.html

  ```
  Important

  A vulnerability rated as Important impact is one which could result in the compromise of data or availability of the server. For Tomcat this includes issues that allow an easy remote denial of service (something that is out of proportion to the attack or with a lasting consequence), access to arbitrary files outside of the context root, or access to files that should be otherwise prevented by limits or authentication.
  ```

  These packages should be updated to use at least Tomcat 9.0.40. Can
  you please provide the update?

  Thanks!

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tomcat9/+bug/1915911/+subscriptions