Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Tomcat version #100

Open
gsainsbury86 opened this issue Nov 23, 2022 · 0 comments
Open

Tomcat version #100

gsainsbury86 opened this issue Nov 23, 2022 · 0 comments

Comments

@gsainsbury86
Copy link

Hi, I've been using the opensilex-docker-compose repo to spin up and run our PHIS instance but it has come up in a scan of Tomcat vulnerabilities: [https://nvd.nist.gov/vuln/detail/CVE-2022-42252](https://nvd.nist.gov/vuln/detail/CVE-2022-42252)

I had a similar issue with the RDF4J container but resolved that with a one-liner change to the Dockerfile to use a different tomcat tag (FROM tomcat:8-jre11 AS wb instead of FROM tomcat:8.5-jre11-temurin AS wb.

I tried the same thing with the Dockerfile for opensilex but noticed that the tomcat version is specified in the Maven pom.xml (as below). In order to update it, I would have to build the entire opensilex application from source, after making the POM change, and then use that built release for the opensilex container.

<tomcat.version>9.0.39</tomcat.version>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant