apache support query.

pma111
pma111 used Ask the Experts™
on
Does apache tomcat have a support lifecycle in the same way that Microsoft apps like Windows do? And how regularly do they issue security updates for tomcat, e.g. monthly? We have got to do some reporting on unsupported software and we don't have an automated vulnerability scanner to do it so its becoming somewhat of a manual reports albeit not over that many systems. I am trying to find some accurate on data though on which to determine 'is it supported or not'.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Fractional CTO
Distinguished Expert 2018
Commented:
1) Does apache tomcat have a support lifecycle in the same way that Microsoft apps like Windows do?

Yes.

http://tomcat.apache.org provides details.

2) And how regularly do they issue security updates for tomcat, e.g. monthly?

There is no set frequency.

Tip: Never, ever, ever install Apache + Tomcat on Windows. Only use a standard LAMP Stack running on something like Ubuntu Bionic (LTS with 5+ years of updates), so when updates release, installation of updates only takes a few seconds to install.

If you use Windows, you must constantly check the Tomcat URL above... daily... then manually reinstall Tomcat for each update.

Tomcat is complex software, so every time you run any manual (by hand) steps, you run the risk of Tomcat simply failing.

3) We have got to do some reporting on unsupported software and we don't have an automated vulnerability scanner to do it so its becoming somewhat of a manual reports albeit not over that many systems. I am trying to find some accurate on data though on which to determine 'is it supported or not'.

The simple fix for this is #2 above, just install any updates as soon as they come out.

Tip: It's highly unlikely any scanner will find a Tomcat problem, before the Tomcat project releases fixes + fixes are pushed through the Ubuntu packaging system to become installable.

Tomcat is rarely used, so there's no monetary incentive for any scanner company to setup + run Tomcat to write code to catch Tomcat problems.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial