PEN test reveals out of date Apache Tomcat on Extreme Control

[RobertD1]

Hello,

What would our response be to a customer that runs a PEN test and has identified the version of Apache Tomcat to be old (not the latest)? Understand that products have to be updated when new updates are made, just don't know whether Apache Tomcat will be updated in-line with times it gets updated. Not seeing the change  in the release notes. 

I think known vulnerabilities are checked against XIQ-SE and NAC and software changes that protect against an issue would be planned for a future release, this would make sense. Unclear if this should be in the release notes or not? 

Seeking advice on this valid security concern and what to say to the end customer.

I can ask for versions of Apache Tomcat on their installed version but just posting to learn more about how to respond to this type of concern.

Rob

[Robert_Haynes · Accepted solution]

Please see https://extreme-networks.my.site.com/ExtrArticleDetail?an=000107545.

In general Extreme provides monthly security vulnerability remediation releases. If your customer is concerned about pen-test results they should upgrade to the latest OS release (24.2.15 at this point) on all supported products (XIQ-SE, Control, Analytics) and re-scan.

If this is a scan on XMC, Control, Analytics 8.5.x then no updates will be provided and the software is AS IS prior to end of life September 2024.

You should also search our SA articles as a number of them have been published over time with various Apache related vulnerabilities and we are either not vulnerable (by design) or we've since upgraded the Apache Tomcat engine.

I believe as of 24.2.15 the Apache TC version is 9.0.87.

[Stefan_K_]

Knowing the exact installed version of Tomcat would indeed be helpful. Security-Fixes are also patched into older releases afaik.

Updates of such components/packages don't make it to the release notes. 

What version of ExtremeControl is in use? 

[RobertD1]

Hi Stefan,

Extreme Control 23.11.12.3.

I will have to ask customer for the Tomcat version.

Edit: 9.0.84 is part of 23.11.12.3.

Thanks,

Rob