Version of Tomcat embedded with Tridion 8.5

Question

One of our client's recent security scans has advised that only Tomcat v7.0.60 or later should be used.

They have a purely Windows based implementation and don't use Tomcat for any of the web applications. However, I'm aware that Tomcat is embedded within some of the core Tridion 8.5 functionality (Microservices, CME Search?, etc.).

The Content Delivery third-party JAR file reference page of the online docs references tomcat-embed-core version 8.5.4 and tomcat-embed-core-8.5.5.jar is in the lib directory of the microservices. Is it safe to assume that this (v8.5.x) is the embedded version that is used throughout the Content Delivery and Content Manager stacks?

If not, how can we tell which version of embeddable Tomcat is being used? If needed, how can this be upgraded?

---

Side note: This is related to my question on disabling SSLv3 for Tridion. It is also partly related to this question: SDL Tridon 2013 SP1 Apache Tomcat 7.0.x Upgrade to 7.0.60

Answer 1

There is a hotfix that updates all microservices to use Tomcat version 8.5.13. - see http://csei.sdl.com/hotfixes/#/hotfixes/c, and search for hotfix CD_8.5.0.4115

I'm not sure if the CM uses some Tomcat version internally. I know it uses Solr for Search, but i don't think that uses Tomcat.