Skip to main content
Category

TomEE

Feb 06
Love0

The Hidden Risk of Running End-of-Life Apache Tomcat, TomEE, and ActiveMQ

By ActiveMQ, CVEs, Security, Tomcat, TomEE No Comments
Understanding End-of-Life (EOL) Products If you’re a developer or manager, you’ve likely faced the challenge of maintaining legacy systems.  You know the delicate balance between keeping your software running, finding the resources for costly upgrades, and managing the expense of growing your team to support emerging issues. When a product like Apache Tomcat, TomEE, or ActiveMQ reaches its End-of-Life (EOL), it stops receiving critical updates and patches from the Open Source Community. This leaves your systems vulnerable to security breaches and compliance issues—a nightmare for developers maintaining these systems and managers responsible for avoiding business risks. Key Risks of Running…
Read More
Jan 08
Love0

Protect Your Tomcat & TomEE: Insights into CVE-2024-50379 & CVE-2024-56337 Vulnerabilities

By CVEs, Security, Tomcat, TomEE No Comments
Overview of CVE-2024-50379 and CVE-2024-56337 in Tomcat and TomEE You may have noticed a couple of new CVEs in Tomcat recently - CVE-2024-50379 and CVE-2024-56337. This vulnerability is rated as “important”, and could lead to remote code execution (RCE), if exploited. As TomEE is built using Tomcat, this will also be an issue for TomEE users. Let’s take a closer look so you can understand the impact and check whether your Tomcat/TomEE configuration may be affected. Detailed Analysis of the Vulnerability and Its Impact From the CVE description:  “If the default servlet is write enabled (readonly initialisation parameter set to…
Read More
Oct 12
Love0

Moving from javax to jakarta namespace

By ActiveMQ, Apache TomEE, Jakarta EE, Java EE, MicroProfile, Open Source, Tomcat, TomEE One Comment
This blog aims at giving some pointers in order to address the challenge related to the switch from `javax` to `jakarta` namespace. This is one of the biggest changes in Java of the latest 20 years. No doubt. The entire ecosystem is impacted. Not only Java EE or Jakarta EE Application servers, but also libraries of any kind (Jackson, CXF, Hibernate, Spring to name a few). For instance, it took Apache TomEE about a year to convert all the source code and dependencies to the new `jakarta` namespace. This blog is written from the user perspective, because the shift from…
Read More
Jan 04
Love0

Apache TomEE MicroProfile 5.0 certified

By MicroProfile, TomEE One Comment
Last year, we announced Apache TomEE as a certified Jakarta EE 9.1 server (See blog post). The season favors gifts and good news, so I thought I would write this small blog to talk about our journey to being MicroProfile 5.0 certified. A while back, Apache TomEE started implementing MicroProfile. At that time, we were contributing to Apache Geronimo implementations for various specifications: config, openapi, opentracing, metrics, health and fault-tolerance. We had our own JWT implementation with additional integration features than what the MicroProfile JWT specification supports. Back then, we were passing the TCK for the MicroProfile 2.1, released October…
Read More
Dec 13
Love0

CVE-2021-44228 – Log4Shell Vulnerability

By CVEs, Tomcat, TomEE No Comments
Introduction If you’ve been following tech news over the last couple of days, you’ll very likely have heard about CVE-2021-44228, or “Log4Shell” as it has become known. This particular vulnerability affects Apache Log4J2, a Java logging framework. Tomcat, TomEE, and ActiveMQ themselves do not ship with log4j2, so running out-of-the-box with their default configuration they are not vulnerable to this issue. However, before you breathe a sigh of relief, you should be aware that applications deployed on either TomEE or Tomcat can include additional Java libraries bundled inside. Any jar file included in a web application’s WEB-INF/lib directory will be…
Read More
Nov 18
Love5

How to use Tibco EMS in TomEE?

By TomEE No Comments
Tomitribe is part of the expert group for the upcoming JMS 3.0 and provides ActiveMQ and Apache TomEE enterprise support for many organizations. This article demonstrates configuring Tibco EMS in TomEE. For generic guidelines on deploying alternative JMS providers, please see the official TomEE documentation for Changing JMS Implementations JMS providers are generally packaged as Java Connector Architecture (JCA) Resource Adapter Archive (RAR) files, and both outbound (for sending messages to the broker) and inbound (for receiving messages via Message Driven Beans (MDBs) connectors are provided. JCA RAR files are designed to be portable, and any portable RAR file should…
Read More
Sep 30
Love6

Custom Identity Store with Jakarta Security in TomEE

By Jakarta EE, TomEE No Comments
In the previous post, we saw how to use the built-in ‘tomcat-users.xml’ identity store with Apache TomEE. While this identity store is inherited from Tomcat and integrated into Jakarta Security implementation in TomEE, this is usually good for development or simple deployments, but may appear too simple or restrictive for production environments.  This blog will focus on how to implement your own identity store. TomEE can use LDAP or JDBC identity stores out of the box. We will try them out next time. Let’s say you have your own file store or your own data store like an in-memory data…
Read More
Aug 31
Love7

Using Tomcat’s `tomcat-users.xml` with Jakarta Security in TomEE

By Jakarta EE, Tomcat, TomEE No Comments
While working on Jakarta EE 10 certification (See announcement Apache Tomee Jakarta EE certified after 10 years, Apache TomEE implemented Jakarta Security specification.  Currently, there is only one implementation used in Glassfish and used by all the other vendors for Jakarta Security. In TomEE, we decided to create an alternative to bring some diversity, and have an Apache implementation. What is Jakarta Security? Jakarta Security defines a standard for creating secure Jakarta EE applications in modern application paradigms. It defines an overarching (end-user targeted) Security API for Jakarta EE Applications. Jakarta Security builds on the lower level Security SPIs defined…
Read More
May 25
Love9

Apache TomEE Jakarta EE certified after 10 years

By Apache TomEE, Community, Jakarta EE, TomEE 2 Comments
We are extremely excited to spread the word that Apache TomEE 9.0.0-M7 has reached Jakarta EE 9.1 Web Profile certification. Speaking with our Apache-contributor hats on, this is not just our first certification in 10 years, but we are doubly proud Apache TomEE is on the list of certified servers on the day of the Jakarta EE release. Moreover, after 3 years of behind-the-scenes work, we're very excited the Apache Software Foundation has joined Jakarta EE Working Group as a Guest Member. And finally, not to be overlooked, the Apache TomEE project has a fresh new website: - https://tomee.apache.org/ As…
Read More
Oct 15
Love11

JakartaONE Brazil 2020: Como alavancar microservices com TomEE e MicroProfile para ajudar a indústria médica no Brasil.

By Apache TomEE, Jakarta EE, JakartaONE, JakartaONE Brazil, TomEE, Tribers vTour No Comments
No dia 29 de agosto, aconteceu o JakartaOne Livestream Brazil. Foi uma conferência virtual de um dia para desenvolvedores e líderes técnicos trazendo o estado atual e futuro de Jakarta EE e tecnologias relacionadas, com foco no desenvolvimento de aplicativos nativos em nuvem corporativa. A participação foi ótima, com cerca de 200 pessoas conectadas continuamente. Nosso parceiro no Brasil, Rafael Guimares, CEO of GBR Sistemas, falou sobre como eles alavancaram microservices com TomEE para ajudar a indústria médica no Brasil. Graças à sua experiência, a equipe de Rafael foi capaz de construir rapidamente um novo aplicativo para suporte à telemedicina no contexto do Coronavírus (consulta...
Read More