nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Tomcat version in Crowd 4.2.2?

We've been made aware of a security vulnerability in Tomcat v8.5.50, which Crowd v4.2.0 (that we're currently using) comes with. Has Tomcat been upgraded if we upgrade Crowd to v4.2.2?

Accepted answers

Gonchik Tsymzhitov

Hi @abbeycode ,

Based on release note unfortunately, not yet

https://confluence.atlassian.com/crowd/crowd-4-2-release-notes-1019381976.html

Please, share the CVE- and I hope Atlassian security team will check the risks.

All comments

Gonchik Tsymzhitov

Hi @abbeycode ,

Based on release note unfortunately, not yet

https://confluence.atlassian.com/crowd/crowd-4-2-release-notes-1019381976.html

Please, share the CVE- and I hope Atlassian security team will check the risks.

I submitted support tickets to Atlassian for Crowd (with two CVEs) and Jira and Bamboo, with one CVE that wasn't patched until Tomcat v8.5.60.

Patched in v8.5.56: CVE-2020-11996

Patched in v8.5.60: CVE-2021-24122

You can use this trick

https://confluence.atlassian.com/jirakb/how-to-upgrade-apache-tomcat-version-used-by-jira-879957866.html

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

crowd