[TOMEE-4229] CVE-2023-34981 in Apache TomEE 8.0.15

• Type: Dependency upgrade
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 8.0.15
• Fix Version/s: 8.0.16
• Component/s: TomEE Core Server
• Labels: CVE
• Assignee: Richard Zowalla
• Reporter: Guzman Castanedo
• Created: 03/Jul/23 07:36
• Updated: 03/Jul/23 17:47
• Resolved: 03/Jul/23 17:46

Description

Hello,

We have seen that Apache Tomcat version 9.0.74 has a high vulnerability (CVE-2023-34981).

Looking Apache TomEE version 8.0.15 it has a Apache Tomcat 9.0.74 inside.

Is this version of TomEE affected by the CVE-2023-34981 vulnerability?

It is planned to solve this CVE in TomEE 8.0.X?

Thank you very much.

Best regards.

References:

• https://tomcat.apache.org/security-9.html
• https://nvd.nist.gov/vuln/detail/CVE-2023-34981

 

Issue Links

• is cloned by: TOMEE-4230 Backport fix for CVE-2023-34981