One of our client's recent security scans has advised that only Tomcat v7.0.60 or later should be used.
They have a purely Windows based implementation and don't use Tomcat for any of the web applications. However, I'm aware that Tomcat is embedded within some of the core Tridion 8.5 functionality (Microservices, CME Search?, etc.).
The Content Delivery third-party JAR file reference page of the online docs references
tomcat-embed-core version 8.5.4 and
tomcat-embed-core-8.5.5.jar is in the
lib directory of the microservices. Is it safe to assume that this (v8.5.x) is the embedded version that is used throughout the Content Delivery and Content Manager stacks?
If not, how can we tell which version of embeddable Tomcat is being used? If needed, how can this be upgraded?
Side note: This is related to my question on disabling SSLv3 for Tridion. It is also partly related to this question: SDL Tridon 2013 SP1 Apache Tomcat 7.0.x Upgrade to 7.0.60