Given a setup where we have
nginx sat in a DMZ serving static content, forwarding (REST/WS) requests through a firewall to
tomcat running on a server where other applications are also running:
YOU <> [FW:443] <> (NGINX) <> [FW:8443] <> (TOMCAT) ( APP1 ) ( APP2 ) ( DB )
Can I focus on just the nginx & tomcat applications in terms of patching CVEs/vulnerable dependencies, or must I ensure that all other applications are as 'CVE-free' as possible.
I believe this is different to this question about whether applications behind a public firewall need to be patched.