Upgrading tomcat to patch CVE-2023-46589

[RMJ5]

Hi,

The latest ant media server version (2.7.0 enterprise) uses tomcat version 8.5.95 which has the high security vulnerability CVE-2023-46589.
How can we upgrade to a patched version?

Thank you

[USAMAWIZARD]

@RMJ5 I have emailed 2 time , I am not sure if my emails are landing in spambox

[RMJ5]

Nothing is there in the spambox

[muratugureminoglu]

Hi @RMJ5

If you are not using Ant Media Server behind a Reverse Proxy, this vulnerability will not affect you. Fortunately, we have resolved this issue by upgrading to Tomcat 10.1.16. You can use Tomcat 10.1.16 in the latest snapshot version, which you can download that version from antmedia.io or obtain by contacting us via the support channel.

Regards.

[RMJ5]

True I found the snapshot version but not sure of upgrading our production server to that. Any timeline for the stable version release? Or can we get 2.7.0 stable with a patched tomcat?

Thanks,

[USAMAWIZARD]

stable version is expected to be released in First half of the Jan