It is fixed in the 8.5.23 (https://tomcat.apache.org/security-8.html) which is the current tomee version
Romain Manni-Bucau @rmannibucau | Blog | Old Blog | Github | LinkedIn 2017-11-23 16:21 GMT+01:00 Matthew Broadhead <[email protected]>: > doesn't redhat use an old version of tomcat? last time i installed from yum > it was really out of date so i installed latest manually. are you sure this > applies to tomee? > > > On 23/11/2017 16:18, dkwakkel wrote: >> >> The latest CVE is of priority HIGH: >> https://access.redhat.com/security/cve/cve-2017-12617. >> Are tomcat vulnerabilities monitored and how is decided if a release will >> be >> made? In my opinion every HIGH vulnerability should result in a >> fixpack/release. If I can be of any help in this subject please let me >> know. >> >> >> >> -- >> Sent from: >> http://tomee-openejb.979440.n4.nabble.com/TomEE-Users-f979441.html > >
