Apache Tomcat should be upgraded to 8.5.88 and 9.0.74 or a later version to fix [CVE-2023-28709|https://nvd.nist.gov/vuln/detail/CVE-2023-28709]
h3. Environment

Bamboo 8, 9

h3. Steps to Reproduce

Check the Apache Tomcat version on {{pom.xml}} or {{<bamboo-install>/bin/version.sh/bat}}

h3. Expected Results

Bamboo 8.x: apache-tomcat 8.5.88 and later
Bamboo 9.x: apache-tomcat 9.0.74 and later

h3. Actual Results

Bamboo 8.x: apache-tomcat 8.5.87 and earlier
Bamboo 9.x: apache-tomcat-9.0.73 and earlier

h3. Workaround

At your own risk, you can manually upgrade Tomcat as instructed on this KB:

[How to upgrade Apache Tomcat version used by Bamboo|https://confluence.atlassian.com/bamkb/how-to-upgrade-apache-tomcat-version-used-by-bamboo-1115656288.html]

{}WARNING{}: Unless still reproducible on official releases, Atlassian Support may refuse support requests for Bamboo running over unofficial Tomcat versions.

CPENameOperatorVersion
bamboo data centerle9.0.2
bamboo data centerle9.3.0
bamboo data centerle9.1.1
bamboo data centerle9.2.1
bamboo data centerle9.1.2
bamboo data centerle8.2.8
bamboo data centerle9.0.3
bamboo data centerle8.1.12
bamboo data centerle9.2.3
bamboo data centerle9.1.3

Name	Operator	Version
bamboo data center	le	9.0.2
bamboo data center	le	9.3.0
bamboo data center	le	9.1.1
bamboo data center	le	9.2.1
bamboo data center	le	9.1.2
bamboo data center	le	8.2.8
bamboo data center	le	9.0.3
bamboo data center	le	8.1.12
bamboo data center	le	9.2.3
bamboo data center	le	9.1.3