nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Confluence with Tomcat 6 web server on windows got security issue

Jonatan Bouillon

I have a confluence server on windows with version 5.3.4 and I realize this week that it works with Tomcat 6.0.X.

And Tomcat 6.0.X got an security issue and it's not supported by confluence. We got hack this week.

I can see that the last version of tomcat 7, 8, 9 got the fix for the sercurity issue but there is no update for version 6.

Fix for CVE-2019-0232, an RCE vulnerability on Windows

I know that this version of confluence is deprecated and I should upgrade but i'm wondering if there is an alternative to using tomcat with confluence or I really need to upgrade?

Accepted answers

JP _AC Bielefeld Leader_

You need to upgrade, sorry!

All comments

JP _AC Bielefeld Leader_

You need to upgrade, sorry!

Jonatan Bouillon

Thanks for the answer.

If I upgrade, the problem seem to be present in the new version of confluence because it's not using the last version of tomcat.

Do you know if I can upgrade tomcat separatly to get the version 9.0.19 of Apache Tomcat that fix the issue.

I know I should upgrade or go to the cloud anyway because my version is deprecate.

Daniel Eads

Hi Jonatan,

We don't recommend trying to upgrade Tomcat separately from Confluence. While the most recent Confluence release (6.15.2) bundles Tomcat 9.0.12, the default setup of Tomcat that Confluence ships with is not in a state that is affected by CVE-2019-0232.

It is possible that the Tomcat setup could be affected, but only if particular features are manually enabled in the server.xml file. This would be an advanced and deliberate change an administrator would need to do. The default setup we provide is not affected under the details of the vulnerability.

Cheers,
Daniel

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

server

confluence-server

upgrade

security

atl-confsec