Bug 2226942 - vunerable Tomcat included in FreeIPA [NEEDINFO]
Summary: vunerable Tomcat included in FreeIPA
Keywords:
Status: CLOSED COMPLETED
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: pki-servlet-engine
Version: ---
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Coty Sutherland
QA Contact: idm-cs-qe-bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-07-27 05:31 UTC by Łukasz Posadowski
Modified: 2023-07-27 14:02 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-07-27 14:02:23 UTC
Type: Bug
Target Upstream Version:
Embargoed:
abokovoy: needinfo? (l.posadowski)

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-163623 0 None None None 2023-07-27 05:33:53 UTC

Description Łukasz Posadowski 2023-07-27 05:31:11 UTC 
Description of problem:
FreeIPA on 

Version-Release number of selected component (if applicable):
ipa-server-4.9.11-6.module+el8.8.0+19022+e8902f4b.x86_64

How reproducible:
Always.

Steps to Reproduce:
1. Install ipa-server with included Tomcat web server in 9.0.40 version.
2. 
3.

Actual results:
Tomcat is outdated.

Expected results:
Tomcat is updated.

Additional info:

# rpm -qa | grep ipa
python3-iniparse-0.4-31.el8.noarch
sssd-ipa-2.8.2-2.el8.x86_64
ipa-healthcheck-0.12-1.module+el8.8.0+17582+6bf5bf91.noarch
ipa-common-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
libipa_hbac-2.8.2-2.el8.x86_64
ipa-healthcheck-core-0.12-1.module+el8.8.0+17582+6bf5bf91.noarch
python3-libipa_hbac-2.8.2-2.el8.x86_64
python3-ipaserver-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
ipa-server-dns-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
ipa-server-common-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
python3-ipaclient-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
ipa-server-4.9.11-6.module+el8.8.0+19022+e8902f4b.x86_64
redhat-logos-ipa-84.5-1.el8.noarch
ipa-client-common-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
python3-ipalib-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
ipa-selinux-4.9.11-6.module+el8.8.0+19022+e8902f4b.noarch
ipa-client-4.9.11-6.module+el8.8.0+19022+e8902f4b.x86_64
Comment 1 Łukasz Posadowski 2023-07-27 05:45:29 UTC 
If You have some test repository with a newer FreeIPA, of there is a way to update Tomcat without touching FreeIPA functionality, please let me know. I would be happy to test the changes.

Thank You.
Comment 2 Alexander Bokovoy 2023-07-27 06:50:28 UTC 
'ipa' package does not provide tomcat at all. Moving this to 'tomcat' package.

You should also provide more substantial clarifications what do you mean by 'vunerable Tomcat included in FreeIPA'.
Comment 3 Florence Blanc-Renaud 2023-07-27 06:54:34 UTC 
On RHEL 8.8, IPA has an indirect dependency on Tomcat and installs version 9.0.50:

# rpm -qa pki-servlet-engine
pki-servlet-engine-9.0.50-1.module+el8.7.0+15761+f86c9a56.noarch

Did you install IPA with idm module enable -y idm:DL1 && idm module install -y idm:DL1/server ? In this case you should have Tomcat 9.0.50, not 9.0.40.
See https://access.redhat.com/errata/RHSA-2022:7470 for more information.
Comment 4 Alexander Bokovoy 2023-07-27 06:58:17 UTC 
Move to the right package (pki-servlet-engine, this is same as tomcat but the one provided by pki-deps module for RHEL IdM needs).
Comment 5 Łukasz Posadowski 2023-07-27 08:18:28 UTC 
Wow. That was freaking *FAST*. Thank You for datailed explanation. We'll handle it from here. Thread can be closed.

Sorry for bothering You about basic stuff. It happens sometimes.
Comment 6 Coty Sutherland 2023-07-27 14:02:23 UTC 
I'm happy to close this out. If you have other questions, please don't hesitate to let us know.
Note You need to log in before you can comment on or make changes to this bug.