How can you upgrade Tomcat for Ant Media Server Enterprise?

[timantmedia]

Version V2.5.3 has security vulnerabilities in Tomcat, such as CVE-2022-42252 and CVE-2023-24998, how do I upgrade Tomcat and fix them?

[mekya]

Hi @timantmedia,

It seems that if we update the libraries, it will be resolved.

You can create an issue and we can update the libraries.

Cheers
Oguz

[mekya]

@timantmedia @muratugureminoglu
Here is the PR to upgrade tomcat and jackson databind
ant-media/ant-media-server-parent#103

I'm checking if enterprise is ok with that.
FYI

[congkuan]

Where can I download the updated library？

[mekya]

It's running in CI for now. After it passes, if everything goes well, it's available in a hour. Then you can download the latest snapshot from your account at antmedia.io
It's listed as Ant Media Server Latest Snapshot(Unstable) in the Subscription > Downloads

You can see the changelog below.
https://antmedia.io/changelog/changelog.html

[mekya]

Hi @congkuan,
The snapshot is ready to download and changelog is updated
https://antmedia.io/changelog/changelog.html

It seems that you need to have Upgrade Packet of Perpetual License to get the latest version because your perpetual license is older than 1 year. If you confirm, I can define it for your account at antmedia.io and let you know.

Looking forward to hearing from you soon

[mekya]

Hi @congkuan,
If you don't want to get the Upgrade Packet of Perpetual License, let us know. We've an item in our manifesto for these cases

Always seek win-win relationships. If a user can’t afford a license, let’s find alternative win-win solutions.

https://antmedia.io/about-us/

Cheers and Have a great weekend