Tomcat Vulnerability CVE-2024-52316

[mdichi]

One of our customers pointed out that this Tomcat vulnerability was found. We have Lucee 5.4.6.9 installed.

https://my.f5.com/manage/s/article/K000149333

I prefer simple fixes. So instead of updating Tomcat, I will try to update Lucee, which I hope will include an updated Tomcat.

Is there an easy way to determine the version of Tomcat included with a Lucee release?

Thanks,
Mike

[Zackster]

Lucee 5.4.7.2 LTS Release

While Lucee is not affected by the recent Tomcat CVE, we are rolling out a 5.4.7 LTS release with the latest versions of Tomcat (9.0.102) and Java (11.0.26-4), plus an update to the bundled cacerts (root certificates for TLS/SSL etc) just to keep your infosec team happy! https://download.lucee.org/changelog/?version=5.4 https://luceeserver.atlassian.net/browse/LDEV-5409 Lucee 6 uses the JVM’s bundled cacerts by default, so it doesn’t need cacerts to be updated. Huh? if you are seeing some cf…

[mdichi]

Is there a date for that release?

[Zackster]

it’s released, we only post release notes for things which are released

I see the “we are rolling” could be misread, I’ll update it