uninstall apache tomcat 8 in windows dzone

If they do not, then they should not be flagged as being vulnerable to log4jshell. But second, if they still had the same 1.x jar file name, then scanners would still find them.Īs I said, smart scanners should see if the log4j 1.x jars have the vulnerable classes. I suppose someone could argue that Adobe “should have” modified the log4j jars in the backup folders, but honestly that would be pointless: for one thing, they are not in any way web accessible (so the fact that scanners would still bark about them is really overkill). I’d recommend archive vs deleting them because there is sometimes value in being able to look at what had been in those prior backups, the update’s logs, etc.Īnd no, to be clear Adobe does NOT modify the log4j jars in those backup folders as part of the update process (because that would fly in the face of that point above, about how restoring from the backup folder brings things back to as before the previous update). It’s that last one which would be used to uninstall the current release (by restoring what’s in its backup folders).

It is indeed safe to delete (or I would recommend, archive/move off the server) the hf-update subfolders beyond the very last update installed.

Uninstall apache tomcat 8 in windows dzone