How to upgrade Tomcat 9.0.87 ?

Question

I set up an EC2 instance a couple of weeks ago (Amazon Linux) and installed Tomcat. The version of Tomcat that I got is 9.0.87. There are no updates available through the "yum" command.

The security guy at my company claims that there is a security flaw in this version (he ran some kind of automated tool, which doesn't really say what the flaw is) and he wants me to upgrade it to the latest version, which I think is 9.0.93.

I really don't want to manually install Tomcat 9.0.93 and then have to mananage updating it myself. Is there a way that I can get the yum command to do this? Or should I just wait? How often do Tomcat updates get to Amazon Linux? Is there a reason they don't happen immediately?

Riku_Kobayashi · Answer

Hello.

Is the Amazon Linux you are using Amazon Linux 2023?  
For Amazon Linux2023, 9.0.91 can be installed.  
```
[root@ip-172-31-41-141 ~]# dnf info tomcat9
Last metadata expiration check: 0:00:49 ago on Wed Aug  7 02:11:26 2024.
Installed Packages
Name         : tomcat9
Epoch        : 1
Version      : 9.0.91
Release      : 1.amzn2023.0.1
Architecture : noarch
Size         : 323 k
Source       : tomcat9-9.0.91-1.amzn2023.0.1.src.rpm
Repository   : @System
From repo    : amazonlinux
Summary      : Apache Servlet/JSP Engine, RI for Servlet 4.0/JSP 2.3 API
URL          : http://tomcat.apache.org/
License      : ASL 2.0
Description  : Tomcat is the servlet container that is used in the official Reference
             : Implementation for the Java Servlet and JavaServer Pages technologies.
             : The Java Servlet and JavaServer Pages specifications are developed by
             : Sun under the Java Community Process.
             :
             : Tomcat is developed in an open and participatory environment and
             : released under the Apache Software License version 2.0. Tomcat is intended
             : to be a collaboration of the best-of-breed developers from around the world.
```

> I really don't want to manually install Tomcat 9.0.93 and then have to mananage updating it myself. Is there a way that I can get the yum command to do this?

The packages that can be installed on Amazon Linux 2023 are managed by AWS, so unless AWS updates them, you will not be able to install the latest version using the dnf or yum command.  
As you know, if you really want to use the latest version, you need to install Tomcat from source.

> Or should I just wait? How often do Tomcat updates get to Amazon Linux? Is there a reason they don't happen immediately?

The update frequency is unknown as it is managed by AWS (information not made public).  
https://docs.aws.amazon.com/linux/al2023/release-notes/all-packages-AL2023.5.html

How to upgrade Tomcat 9.0.87 ?

Add your answer

Relevant content