[PLUTO-788] Upgrade to Tomcat 8.5.69 due to multiple CVE issues

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.0
• Fix Version/s: 3.1.1
• Component/s: build system
• Assignee: Neil Griffin (Inactive)
• Reporter: Neil Griffin (Inactive)
• Created: 13/Jul/21 22:49
• Updated: 14/Dec/22 14:37
• Resolved: 13/Jul/21 22:54

Description

This task involves upgrading from Tomcat 8.5.40 to Tomcat 8.5.69 (the latest release of Tomcat 8.x at the time of this writing) in order to benefit from security vulnerability fixes found in Tomcat. For more information, see the CVE Details for Apache Tomcat as well as the following issues:

• CVE-2021-30639 Apache Tomcat DoS
• CVE-2021-30640 Apache Tomcat JNDI realm authentication weakness
• CVE-2021-33037 Apache Tomcat HTTP request smuggling

Issue Links

• relates to: PLUTO-793 TCK: Contesting assumptions of PortletContext.getRealPath(String) in V2EnvironmentTests_PortletContext_ApiRender_getRealPath3