Does Apache Tomcat come embedded with ArcGIS Enterprise Installation?

[MichaelTorbett]

I have ArcGIS Enterprise 10.6.1 installed on a virtual machine with a Windows IIS Web Adapter. My network administrator recently did a security scan that shows an old version of Apache Tomcat. It either needs to be upgraded or uninstalled to be is compliance with my agency's security policy.  However, I cannot find any evidence of it being installed.  Does Apache Tomcat come embedded with ArcGIS Enterprise?

Thanks,

Michael

[ReeseFacendini · Accepted solution]

Yes Enterprise has Apache Tomcat embedded, which helps during installation.  The only way to upgrade the internal version of Tomcat is to upgrade Enterprise as a whole.

[MichaelTorbett]

Thank you for the answer Reese. That tells me what I need to know. 

[ModyBuchbinder]

Hi All

Return to this old post.

Is it documented some where what version of tomcat is embedded?

Tomcat have some vulnerabilities ( https://tomcat.apache.org/security-9.html) is there any way to know that they do not affect server/portal products?

[JoshuaBixby]

Short answer, not documented, at least that I have ever seen publicly.  However, simple to determine, just run the version.sh or version.bat file in AGSSERVER/framework/runtime/tomcat/bin folder.

[ToddW_stl]

hi Molly - this technical support "how to" article seems to provide what you're looking for.

Identify the version of Apache Tomcat in ArcGIS Server (no longer works)

These steps should allow you to check the Tomcat version embedded within ArcGIS Server.

For further information on how Apache differs from Tomcat and its role as the Servlet Engine, please use the below link. 
Tomcat vs. Apache HTTP Server: What's the difference? (theserverside.com

1. Open a Command prompt as Administrator on the ArcGIS Server machine
2. Run a change directory to the ArcGIS Server application directory
   • cd C:/Program Files/ArcGIS/Server/framework/runtime/tomcat/bin
3. Run "version.bat" in command prompt
4. Note Server Version towards the middle of the prompt
   • 

[JoshuaBixby]

@ToddW_stl, the link provided is dea.

[ToddW_stl]

thanks - i've updated my post above!

[ModyBuchbinder]

Thanks for the help

On my server 11.3 I get 9.0.86.0

Anybody know what is it for 11.4?

I return to my original question - does the vulnerabilities  on the tomcat effect server machines?

[ToddW_stl]

I'd suggest contacting Esri’s Software Security & Privacy Team at SoftwareSecurity@Esri.com (and posting the response/answer here).