CVE on Tomcat 9.0.0-9.0.9 and 8.5.5-8.5.31, ie Jamf Pro 10.6

[L-plateAdmin]

Just had my security guys pick me up about the Tomcat released with 10.6 thats currnetly on our pre box. dont like the idea of updating tomcat outside Jamf so reached out to our account manager to see if at least Jamf is aware.

http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C20180722090623.GA92700@minotaur.apache.org%3E

[bpavlov]

And what did Jamf say?

[rderewianko]

Posting so i get notified of new posts too ;)

[kstrick]

have a feeling we may see a Jamf Pro 10.6.1 with updated tomcat

[stephanpeterson]

following....

[donmontalvo]

Following...

[snovak]

Joining the conga line

[dgreening]

Oof I have the upgrade scheduled for this weekend. I reached out to Jamf for comment.

[dmw3]

Following...

[jriv]

Interested

[dgreening]

Jamf suggested using the root.war manual upgrade path to me. This would be upgrading without upgrading Tomcat itself.

EDIT - Spoke with Jamf again and they don't want us changing our upgrade method from the Windows .msi based one. To be continued another weekend.

[c_archibald]

So is Apache Tomcat 8.5.31 not updatable without breaking JAMF? Because 8.5.32 is current including REQUIRED patching from 8.5.31.

[bpavlov]

@ryan.yohnk I don't know if you're the right person to tag on this, but you had responded to my discussion on Java support moving forward.

I was wondering whether you or someone else on Jamf could comment on the current situation with the Tomcat CVEs being discussed here.

[dgreening]

We are in a hold pattern on Jamf upgrades until the CVE(s) are closed out. Interested to know where we are in closing these out.

[joe_bloom]

Jamf is planning a release associated with this vulnerability based on the severity. I cannot share a timeline yet on when, but it is in process.

[cdenesha]

Pro Tip: Instead of posting a one-word comment to the thread to be informed of future updates, 'Add Bookmark'.

:)

[rderewianko]

But i like adding to my count of new notifications.

[joe_bloom]

P.S. We released 10.6.2 on August 21 to address this CVE. You can find 10.6.2 in Jamf Nation in your assets. What's New in 10.6.2