Pega 8.7.4 in Tomcat 10
Hi
We are asked to use Tomcat 10 for vulnerabilities. IS Pega 8.7.4 compatible with Tomcat 10? We are getting issues
Below link suggests changes but is Pega compatible?
Pegasystems Inc.
GB
@Arvind please consult our Platform Support Guide.
BNYMellon Technology
IN
@MarijeSchillern Thanks. Referred the guide, it doesnt list Tomcat 10. can we know when we can have Pega under Tomcat 10? We have vulnerabilities in Tomcat 9.
Updated: 7 Mar 2023 8:23 EST
Pegasystems Inc.
GB
@Arvind all the vulnerabilities that are reported and investigated by our Support team are documented in our Security Bulletins.
These Security Advisories can also be found as Support Documents.
Please go through any recommended hotfixes/ suggestions and if you do not see your particular Tomcat vulnerability listed, please log a support Incident via the MSP.
Please can you provide the INC id here so that we can help track the progress of your issue?
BNYMellon Technology
IN
@MarijeSchillern created INC-264107
Updated: 9 Mar 2023 7:20 EST
Pegasystems Inc.
GB
@Arvind thanks for the info.
I do wonder, though... The issue you have logged is ".The Pega web application need to be compatible to Jakarta EE version 9 to be compatible and deploy successfully on Tomcat 10."
I am not clear on why you have updated the Tomcat version to a version that is not supported by the Pega Platform.
What is the actual vulnerability which led you to that action?
Likely the support team will inform you of the same info I have already provided. ( If there is no impact to Pega then likely it is not considered a factor for update).
----> Please can you give the exact vulnerability which you encountered using Tomcat 9 *whilst using Pega *.
BNYMellon Technology
IN
@MarijeSchillern I have attached a document named Tomcat10.pdf in the INC, that lists the Vulnerabilities of tomcat9. Attaching the same here.
Accepted Solution
Updated: 11 Apr 2023 6:55 EDT
Pegasystems Inc.
GB
@Arvind the support ticket is now closed as the support team echoed the analysis I provided earlier.
"We have discussed internally and as per Pega Platform support guide Tomcat 10 is unsupported for your platform version
. From the document it seems all of them appear to have Tomcat 9 versions that resolve the issue. Also, the latest version of Tomcat 9 is 9.0.73, released Feb 27.
https://tomcat.apache.org/tomcat-9.0-doc/changelog.html
Our engineering team confirmed that Pega platform will not support Tomcat 10 in anytime near future for your version.
You might reach out to Apache for any such vulnerabilities.
Support Guide : https://docs-previous.pega.com/pega-platform-support-guide-resources"