The AJP connector causing the vulnerability is disabled in Ubuntu by default ( Comment #1 for bug #1865904). Recommended in the security guide) that this Connector would be In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 toħ.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. To an attacker, they can be exploited in ways that may be surprising. Tomcat treats AJP connections as having higher trust than, forĮxample, a similar HTTP connection. The GhostCat is a vulnerability related to default configuration rather than code. However, upgrading the package is a XY problem, and instead of upgrading you should be. Installing software from places other than official Debian repositories are not covered by Debian' Security team. The latest version of the software you're trying to use might also have new bugs. Version number does not take this into account. Somewhere other than the Debian Stable repositories, here are someĭebian backports security fixes and new features, judging software by comparing the version number of the Debian package to the upstream
INSTALL APACHE TOMCAT UBUNTU 17.10 INSTALL
This is reasoned quite well in DontBreakDebian: Don't suffer from Shiny New Stuff Syndrome, and applies to Ubuntu as well:īefore attempting to install the newest version of some software from
INSTALL APACHE TOMCAT UBUNTU 17.10 UPGRADE
If you really needed a newer version for compatibility reasons or the new features provided, you should rather upgrade your whole distribution.įor security updates you should wait until its fixed in the distribution.
You could also compile your own, but in that case, you lose all automatic security updates: either your system becomes vulnerable or you need to compile your Tomcat over and over again.įor everyone who needs to ask this question messing up with the repositories is extremely dangerous and never recommended. You could install packages from another version of Ubuntu, but that might break some dependencies: it makes maintaining your system harder or in worst case renders it useless. You are already at the newest version for your distribution! The tomcat8 package for bionic (18.04LTS) is currently 8.5.39-1ubuntu1~18.04.3 and focal (20.04LTS) already has tomcat9.
0 kommentar(er)
