question Re: Cloudera 5.16.2: Tomcat upgrade in Support Questions

Cloudera 5.16.2: Tomcat upgrade

CaptainJa — Tue, 11 Feb 2020 09:39:14 GMT

Hello,

After running a security tool on our cluster, a report found the tomcat version as outdated and vulnerable to certain threats. We have tried to find ways to upgrade Tomcat on our cluster but are not having any success with it.

I realize this is similar to a post https://community.cloudera.com/t5/Support-Questions/Apache-tomcat-compatibility/m-p/159988 which concerns HDP but there are no responses on that post either.

Does anyone have some experience with this? If so, I would be grateful for some pointers.

Thanks.

Regards,

CaptainJay

Re: Cloudera 5.16.2: Tomcat upgrade

StevenOD — Tue, 11 Feb 2020 13:53:05 GMT

Hi @CaptainJa

Are you able to upgrade your environment to CDH 6? In CDH 6 Tomcat is replaced by Jetty. Please take a look at this post:

https://blog.cloudera.com/third-party-libraries-in-c6/

Regards,

Steve

Re: Cloudera 5.16.2: Tomcat upgrade

CaptainJa — Tue, 11 Feb 2020 17:37:14 GMT

Hello @StevenOD,

Thanks for the reply. We have considered this but at the moment, the client requirements limits our usage to 5.16.x

Re: Cloudera 5.16.2: Tomcat upgrade

GangWar — Fri, 14 Feb 2020 13:56:44 GMT

@CaptainJa The version of Tomcat used in CDH 5.16.2 should not have any vulnerabilities. Could you share the CVE that is reported CDH is vulnerable to?

Per the notice [1] independent upgrade of Tomcat is not supported and we are moving towards newer versions in CDH6 => Cloudera Enterprise 6 has replaced Tomcat 6 with Jetty 9 and is not susceptible to Tomcat security issues.

LINKS: [1] https://community.cloudera.com/t5/Customer/CDH-5-support-for-Tomcat-6/ta-p/73655