2 ms·
The Spring Boot comment should be elaborated on (I was surprised Spring guys didn't write anything about it in their blog). This is off by default, but you cou
by keeganwitt 7y ago
The Spring Boot comment should be elaborated on (I was surprised Spring guys didn't write anything about it in their blog). This is off by default, but you could be vulnerable if you configured it to be on (I'd look for a bean definition of `EmbeddedServletContainerFactory` that adds a connector with `new Connector("AJP/1.3")`). If that's the case, you can either upgrade Spring Boot to pull in an updated Tomcat, or override the Tomcat version with the `tomcat.version` property.