A number of customers have upgraded Tomcat 8.5 that comes with Dimensions CM to newer 8.5.x versions in order to resolve some vulnerabilities. However, after Tomcat is upgraded some of the Connectors fail to start up. Tomcat logs include the following errors:
The main concern with tomcat versions prior to 8.5.51 is the AJP connector, which is not used by Dimensions CM. Therefore we recommend this is commented out from tomcat / 8.5 /conf/server.xml. 1/ Stop the Micro Focus Tomcat service
Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'databaseSchemaUpgrade' defined in URL [jar:file:/C:/Program%20Files/Micro%20Focus/common/ tomcat / 8.5 /webapps/pulse/WEB-INF/lib/platform-dbschema-14.5.0-SNAPSHOT.jar!/META-INF/starlight/app-components.xml]:
The attached HotFix solves the following issue in VM 8.5.3: DEF307915: Upgrade to Tomcat 7.0.82 to avoid vulnerabilities CVE-2017-12615 and CVE-2017-12617
To work around this issue, all Diffie-Hellman ciphers must be disabled on the Tomcat server that is used by the Serena VM Web Application to run the VM File Server. Instructions on how to change these ciphers can be found in KB article S139650 .
An h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
