This FAQ section provides help with some security-related issues.
If you hear of a vulnerability or its exploitation, please let us know
on the user
mailing lists.
| The Record |
Tomcat's security record is impeccable. There have been no public
cases of damage done to a company, organization, or individual due
to a Tomcat security issue. There have been no documented cases
of data loss or application crashes caused by an intruder. While
there have been numerous analyses conducted on Tomcat, partially
because this is easy to do with Tomcat's source code openly available,
there have been only a few theoretical vulnerabilities
found. All of those were addressed rapidly even though there were no
documented cases of actual exploitation of these vulnerabilities.
|
| Role of Customization |
We believe, and the evidence suggests, that Tomcat is more than secure
enough for most use-cases. However, like all other components of Tomcat,
you can customize any and all of the relevant parts of the server to
achieve even higher security. For example, the session manager implementation
is pluggable, and even the default implementation has support for pluggable
random number generators. If you have a special need that you feel is not
met by Tomcat out of the box, consider these customization options. At the
same time, please bring up your requirements on the user mailing list, where
we'll be glad to discuss it and assist in your approach/design/implementation
as needed.
|
|
