topic Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation? in ArcGIS Enterprise Questions

Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

MichaelTorbett — Tue, 13 Jul 2021 19:29:03 GMT

I have ArcGIS Enterprise 10.6.1 installed on a virtual machine with a Windows IIS Web Adapter. My network administrator recently did a security scan that shows an old version of Apache Tomcat. It either needs to be upgraded or uninstalled to be is compliance with my agency's security policy. However, I cannot find any evidence of it being installed. Does Apache Tomcat come embedded with ArcGIS Enterprise?

Thanks,

Michael

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

ReeseFacendini — Tue, 13 Jul 2021 19:39:02 GMT

Yes Enterprise has Apache Tomcat embedded, which helps during installation. The only way to upgrade the internal version of Tomcat is to upgrade Enterprise as a whole.

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

MichaelTorbett — Tue, 13 Jul 2021 20:31:10 GMT

Thank you for the answer Reese. That tells me what I need to know.

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

ModyBuchbinder — Tue, 12 Nov 2024 14:27:12 GMT

Hi All

Return to this old post.

Is it documented some where what version of tomcat is embedded?

Tomcat have some vulnerabilities ( https://tomcat.apache.org/security-9.html) is there any way to know that they do not affect server/portal products?

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

JoshuaBixby — Tue, 12 Nov 2024 15:04:22 GMT

Short answer, not documented, at least that I have ever seen publicly. However, simple to determine, just run the version.sh or version.bat file in AGSSERVER/framework/runtime/tomcat/bin folder.

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

ToddW_stl — Tue, 10 Dec 2024 19:34:44 GMT

~~hi Molly - this technical support "how to" article seems to provide what you're looking for.~~

~~Identify the version of Apache Tomcat in ArcGIS Server (no longer works)~~

These steps should allow you to check the Tomcat version embedded within ArcGIS Server.

For further information on how Apache differs from Tomcat and its role as the Servlet Engine, please use the below link.
Tomcat vs. Apache HTTP Server: What's the difference? (theserverside.com

Open a Command prompt as Administrator on the ArcGIS Server machine
Run a change directory to the ArcGIS Server application directory
- cd C:/Program Files/ArcGIS/Server/framework/runtime/tomcat/bin
Run "version.bat" in command prompt
Note Server Version towards the middle of the prompt

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

ModyBuchbinder — Wed, 13 Nov 2024 05:30:14 GMT

Thanks for the help

On my server 11.3 I get 9.0.86.0

Anybody know what is it for 11.4?

I return to my original question - does the vulnerabilities on the tomcat effect server machines?

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

ToddW_stl — Wed, 13 Nov 2024 17:16:00 GMT

I'd suggest contacting Esri’s Software Security & Privacy Team at SoftwareSecurity@Esri.com (and posting the response/answer here).

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

alexanderzitzmann — Tue, 10 Dec 2024 14:36:47 GMT

Gibt es hier schon Erkenntnisse, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52316 wird bei uns als kritisch eingestuft.

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

JoshuaBixby — Tue, 10 Dec 2024 18:04:01 GMT

@ToddW_stl, the link provided is dea.

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

JoshuaBixby — Tue, 10 Dec 2024 18:06:08 GMT

ArcGIS Enterprise 11.4.0 has Apache Tomcat/9.0.93

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

ToddW_stl — Tue, 10 Dec 2024 19:35:02 GMT

thanks - i've updated my post above!

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

vipulsoni — Wed, 15 Jan 2025 04:27:48 GMT

Hi @JoshuaBixby ,

As per Apache Tomcat (https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r) it seems the ArcGIS Enterprise 11.4.0 is also having Vulnerable Version of embedded Tomcat installed. There are no patches from ESRI yet for this issue.

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

alexanderzitzmann — Wed, 15 Jan 2025 07:08:33 GMT

i downloaded latest apache-tomcat and replaced it at framework/runtime/tomcat/lib, testet on 11.2 linux, no problems so far.

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

George_Thompson — Wed, 15 Jan 2025 11:35:34 GMT

I would go over and review this CVE on the Trust | ArcGIS site. There may be some information on this.

Also read this thread about updating tomcat outside of the ArcGIS software upgrade / patches: https://community.esri.com/t5/arcgis-enterprise-questions/apache-tomcat-vulnerability-cve-2024-50379/td-p/1569975

Re: Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

JoshuaBixby — Wed, 15 Jan 2025 16:18:50 GMT

As covered in Apache Tomcat vulnerability CVE-2024-50379 - Esri Community , the vulnerability is not applicable to ArcGIS Server I do not expect Esri to release a patch.