0

On Ubuntu 16.04 I've been using the tomcat8 package. I enjoyed an automatic installation process and was guaranteed to receive packaged security updates for 5 years courtesy of Canonical. So, even though version 8.0 has been declared EOL, I can still use it on my Ubuntu server knowing that any vulnerabilities are going to be addressed.

$ ubuntu-support-status --show-supported
Supported until April 2021 (Canonical - 5y):
tomcat8 tomcat8-admin tomcat8-common

Much to my dismay, on Ubuntu 18.04 the tomcat8 package has been moved to Universe. In my understanding, there is no support guarantee and security patches may or may not be distributed as long as the mainstream product is supported by the Apache Foundation.

Is my understanding of things correct? Is there a convenient way to keep tomcat patched with security updates on Ubuntu 18.04 as easily as with 16.04?

Update: To be clearer, with 16.04 I could simply run apt update tomcat8 and be sure that there would be no vulnerabilities left unpatched. Running the same command today on 18.04, I get version 8.5.30-1ubuntu1 which is behind the latest available (8.5.37) and apparently affected by more than one known vulnerabilities.

Improve this question

1 Answer 1

Reset to default
1

In my understanding, there is no support guarantee and security patches may or may not be distributed as long as the mainstream product is supported by the Apache Foundation.

Correct but it is in their best interest to keep support up as long as possible.

Is there a convenient way to keep tomcat patched with security updates on Ubuntu 18.04 as easily as with 16.04?

Nothing changes for you; it only comes from a more direct channel so if anything you should see updates appear quicker and not just security updates.

Old: update tomcat by Apache -> Ubuntu security team evaluates changes and adds patches if that specific package has Ubuntu related changes -> update to you.

New: update tomcat by Apache -> update to you.

Canonical decided to kill the changes made to the package and as such could take it out of security. The fewer the changes to our default install means fewer issues. It is likely to happen and has happened with lots of other software since Canonical stopped with Unity: we are going back to the original source for our software.

Improve this answer
1
  • Thank you for the answer. I don't see it as an improvement, though, since in practice I end up having insecure tomcat versions. I'm thinking of a way of always having the latest version, maybe Docker can help...
    – simlev
    Jan 15, 2019 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .