Skip to content

Update tomcat to fix security vulnerabilities #155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jun 23, 2025
Merged

Update tomcat to fix security vulnerabilities #155

merged 1 commit into from
Jun 23, 2025

Conversation

sohyun-ku
Copy link
Contributor

Upgraded embedded Tomcat to version 10.1.42 to address the following security vulnerabilities:

  • CVE-2025-49125: Security constraint bypass via PreResources and PostResources
  • CVE-2025-49124: Side-loading vulnerability in Windows installer
  • CVE-2025-48988: Potential DoS via multipart upload memory exhaustion
  • CVE-2025-48976: Potential DoS in Commons FileUpload due to large headers

Applied Changes

  • api
image
  • collector
image

@sohyun-ku sohyun-ku self-assigned this Jun 19, 2025
@sohyun-ku sohyun-ku requested review from junoyoon and a team as code owners June 19, 2025 07:53
@github-actions GitHub Actions
Copy link

Scavenger Test Results

166 files  166 suites   2m 59s ⏱️
277 tests 271 ✅ 6 💤 0 ❌
299 runs  293 ✅ 6 💤 0 ❌

Results for commit 3af8fae.

taeyeon-Kim
taeyeon-Kim approved these changes Jun 19, 2025
View reviewed changes
Copy link
Contributor

@taeyeon-Kim taeyeon-Kim left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@sohyun-ku sohyun-ku merged commit e451097 into develop Jun 23, 2025
6 checks passed
@sohyun-ku sohyun-ku deleted the feature/bump-up-tomcat branch June 23, 2025 05:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kojandy kojandy kojandy approved these changes

@taeyeon-Kim taeyeon-Kim taeyeon-Kim approved these changes

@junoyoon junoyoon Awaiting requested review from junoyoon junoyoon is a code owner

Assignees

@sohyun-ku sohyun-ku

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@sohyun-ku @kojandy @taeyeon-Kim