We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42.
Users have expressed their concerns about Java 7's support/updates being discontinued by oracle in April 2015 and has requested for the environment's Java version to be upgrade to version 8. However, by doing so, we are afraid that the application's behavior might change, as we have observed during coding and testing when one of the developers was using JRE 8 instead of 7. This might also mean that we would need to upgrade the 3rd party libraries we used such as OJDBC and even upgrade the Tomcat version.
My question are:
- What are the security concerns if we are to stick with an old JRE version?
- What can we do to mitigate the security concerns?
- Isn't it the responsibility of the web server's, load balancer's (and such) security features to prevent security issues for the Java versions they supposedly support?
All of you suggested that it's necessary to upgrade a server's Java version. However, this is a big and very complex application with lots of dependencies; upgrading would mean performing costly regression testing on the whole system. My additional questions are:
- Does the risk outweigh the incurred costs? Are the risks that great to justify additional testing and potential re-coding?
- How can a malicious attacker exploit an outdated Java version? My understanding is, services/ports that are directly communicating with external users are the only entry point to an internet-base attack (assume no internal attacks). Then, isn't it the job of the Operating System and services to ensure that there are no exploitable bugs?