Bug 2226942

Summary:	vunerable Tomcat included in FreeIPA
Product:	Red Hat Enterprise Linux 8	Reporter:	Łukasz Posadowski <l.posadowski>
Component:	pki-servlet-engine	Assignee:	Coty Sutherland <csutherl>
Status:	CLOSED COMPLETED	QA Contact:	idm-cs-qe-bugs
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	---	CC:	abokovoy, frenaud, rcritten, rhcs-maint, tscherf
Target Milestone:	rc	Flags:	abokovoy: needinfo? (l.posadowski)
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-07-27 14:02:23 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Łukasz Posadowski 2023-07-27 05:31:11 UTC

Description of problem:
FreeIPA on 

Version-Release number of selected component (if applicable):
ipa-server-4.9.11-6.module+el8.8.0+19022+e8902f4b.x86_64

How reproducible:
Always.

Steps to Reproduce:
1. Install ipa-server with included Tomcat web server in 9.0.40 version.
2. 
3.

Actual results:
Tomcat is outdated.

Expected results:
Tomcat is updated.

Additional info:

# rpm -qa | grep ipa
python3-iniparse-0.4-31.el8.noarch
sssd-ipa-2.8.2-2.el8.x86_64
ipa-healthcheck-0.12-1.module+el8.8.0+17582+6bf5bf91.noarch
ipa-common-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
libipa_hbac-2.8.2-2.el8.x86_64
ipa-healthcheck-core-0.12-1.module+el8.8.0+17582+6bf5bf91.noarch
python3-libipa_hbac-2.8.2-2.el8.x86_64
python3-ipaserver-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
ipa-server-dns-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
ipa-server-common-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
python3-ipaclient-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
ipa-server-4.9.11-6.module+el8.8.0+19022+e8902f4b.x86_64
redhat-logos-ipa-84.5-1.el8.noarch
ipa-client-common-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
python3-ipalib-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
ipa-selinux-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
ipa-client-4.9.11-6.module+el8.8.0+19022+e8902f4b.x86_64

Comment 1 Łukasz Posadowski 2023-07-27 05:45:29 UTC

If You have some test repository with a newer FreeIPA, of there is a way to update Tomcat without touching FreeIPA functionality, please let me know. I would be happy to test the changes.

Thank You.

Comment 2 Alexander Bokovoy 2023-07-27 06:50:28 UTC

'ipa' package does not provide tomcat at all. Moving this to 'tomcat' package.

You should also provide more substantial clarifications what do you mean by 'vunerable Tomcat included in FreeIPA'.

Comment 3 Florence Blanc-Renaud 2023-07-27 06:54:34 UTC

On RHEL 8.8, IPA has an indirect dependency on Tomcat and installs version 9.0.50:

# rpm -qa pki-servlet-engine
pki-servlet-engine-9.0.50-1.module+el8.7.0+15761+f86c9a56.noarch

Did you install IPA with idm module enable -y idm:DL1 && idm module install -y idm:DL1/server ? In this case you should have Tomcat 9.0.50, not 9.0.40.
See https://access.redhat.com/errata/RHSA-2022:7470 for more information.

Comment 4 Alexander Bokovoy 2023-07-27 06:58:17 UTC

Move to the right package (pki-servlet-engine, this is same as tomcat but the one provided by pki-deps module for RHEL IdM needs).

Comment 5 Łukasz Posadowski 2023-07-27 08:18:28 UTC

Wow. That was freaking *FAST*. Thank You for datailed explanation. We'll handle it from here. Thread can be closed.

Sorry for bothering You about basic stuff. It happens sometimes.

Comment 6 Coty Sutherland 2023-07-27 14:02:23 UTC

I'm happy to close this out. If you have other questions, please don't hesitate to let us know.