Timeline for Is it necessary to update JRE in an Apache Tomcat Server?
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 11, 2015 at 6:32 | comment | added | Motivated | @user3367701 - I would take the approach of "assume breach" i.e. it's either already happened, in the process of occurring or a matter of time before it occurs. How critical is the system if it were breached? If you are simply looking at minimizing the risks immediately with minimal overhead, i would highly recommend services such as F5's Silverline. There are others too. The other option to assess the risks is to look at penetration tests, run vulnerability scans, etc to assess the risks and impacts. | |
| Nov 11, 2015 at 2:16 | history | edited | user3367701 |
edited tags
|
|
| Nov 11, 2015 at 2:09 | history | edited | user3367701 | CC BY-SA 3.0 |
added 749 characters in body
|
| Nov 11, 2015 at 2:01 | comment | added | user3367701 | @dave_thompson_085 7u51 was the latest version when coding started. For compatibility between Java 7 and 8, we tested one complex module that behaved entirely differently in Java 8, upon shallow investigation of the problem, this was probably due to the implementation changes in Java Regex | |
| Nov 11, 2015 at 0:48 | comment | added | dave_thompson_085 | 7u51 is Dec 2013, more than a year before the EOL; you should update to at least 7u80. J8 is designed to be upward compatible with very few exceptions, and for application (not applet) running on 8 vs 7 with no code change I've not noticed any material difference other than improvements in TLS and slightly different memory tuning; if you have specific differences that cause trouble or concern you could ask about them (probably SO but maybe here if security). Similarly old libraries and Tomcat should run fine on new Java, but maybe not the reverse. | |
| Nov 10, 2015 at 11:54 | answer | added | WoJ | timeline score: 0 | |
| Nov 10, 2015 at 10:19 | answer | added | Krishna Pandey | timeline score: 0 | |
| Nov 10, 2015 at 8:37 | answer | added | Sir Cornflakes | timeline score: 1 | |
| Nov 10, 2015 at 7:47 | comment | added | Motivated | Depending on the urgency to patch, the threat model, etc, a consideration may be to look at leveraging managed services such as F5's Silverline offering. This will give you the window of opportunity to assess the risks, impact as well as look at updating to the latest version depending on whether you have test systems. | |
| Nov 10, 2015 at 7:27 | comment | added | user3367701 | @Motivated yes it is | |
| Nov 10, 2015 at 7:27 | comment | added | Motivated | Is this an external facing system? | |
| Nov 10, 2015 at 7:24 | review | First posts | |||
| Nov 10, 2015 at 7:59 | |||||
| Nov 10, 2015 at 7:19 | history | asked | user3367701 | CC BY-SA 3.0 |