<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Apple Color Emoji";
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-IE" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">Thanks for pointing this out Roger. I’ve rebuilt the image using the current tomcat:8.5-jdk8 container (i.e. docker build --pull etc). I’ll look into automatic it after Christmas.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US">Matthew<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">IPT <ipt-bounces@lists.gbif.org> on behalf of Roger W. J. Alterskjær via IPT <IPT@lists.gbif.org><br>
<b>Date: </b>Friday, 23 December 2022 at 01:01<br>
<b>To: </b>IPT@lists.gbif.org <IPT@lists.gbif.org><br>
<b>Subject: </b>Re: [IPT] Update docker tomcat?<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">Ugh. And now I see I overlooked where tomcat comes into play in the Dockerfile:
</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US"><a href="https://github.com/gbif/ipt/blob/master/package/docker/Dockerfile">https://github.com/gbif/ipt/blob/master/package/docker/Dockerfile</a></span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">Line 17: FROM tomcat:8.5-jdk8</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">Perhaps ‘tomcat:8.5.84-jdk8’?</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">And I suppose it’s Matthew that will need to check this out.
</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Apple Color Emoji";mso-fareast-language:EN-US">😊</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">-Roger A</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">IPT <ipt-bounces@lists.gbif.org> on behalf of Roger W. J. Alterskjær via IPT <ipt@lists.gbif.org><br>
<b>Date: </b>Thursday, 22 December 2022 at 13:44<br>
<b>To: </b>IPT@lists.gbif.org <IPT@lists.gbif.org><br>
<b>Subject: </b>[IPT] Update docker tomcat?</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;mso-fareast-language:EN-US">Our university IT-security guys have noticed that our docker container for gbif/ipt is running a vulnerable version of Tomcat:
</span><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#242424;background:white;mso-fareast-language:EN-US">Apache Tomcat 8.5.x < 8.5.83</span><span lang="EN-US" style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#242424;background:white;mso-fareast-language:EN-US">
which is vulnerable to </span><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#242424;background:white;mso-fareast-language:EN-US">"Request Smuggling Vulnerability" (CVE-2022-42252)</span><span lang="EN-US" style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#242424;background:white;mso-fareast-language:EN-US">.
They say that Tomcat </span><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#242424;background:white;mso-fareast-language:EN-US">8.5.84 </span><span lang="NO-BOK" style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#242424;background:white;mso-fareast-language:EN-US">is
the latest version of 8.5.</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="NO-BOK" style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#242424;background:white;mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#242424;background:white;mso-fareast-language:EN-US">I see that we’re using maven:3.8-jdk-8 with hasn’t been updated for five months…</span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#242424;background:white;mso-fareast-language:EN-US"> </span><o:p></o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#242424;background:white;mso-fareast-language:EN-US">-Roger A</span><o:p></o:p></p>
</div>
</body>
</html>