Spotfire Server: Upgrading Apache Tomcat in Spotfire Server 14

April 01, 2025 10:40
Updated

Upgrading Apache Tomcat in Spotfire 14 will ensure systems are security compliant with regards to vunerability CVE-2025-24813

To upgrade Tomcat first download a copy of Apache Tomcat. Then follow the upgrade instructions from the Spotfire community site

Once these instructions have been completed the Tomcat version can be check with <installation root>\tomcat\bin\version.bat. On Linux use version.sh

Post uprade it is necessary to make the following changes

Update Solidus handling on the Spotfire Server

1. Export the server config

config export-config

2. Alter solidus handling

config set-config-prop --name="security.trust.registration-connector.attributes.solidusHandling.key"
--value="encodedSolidusHandling"

config set-config-prop --name="security.trust.registration-connector.attributes.solidusHandling.value"
--value="decode"

3. Import the server config again

config import-config -c "Altered solidus handling"

4. Restart the Spotfire Server

Disable the local OCSP proxy

These steps must be performed on each node manager in the cluster.

Windows Node Manager

Shutdown the node manager service
Edit the <version>\nm\winsw.xml file by adding the env element as shown below

  <service>
  ...
  <env name="JAVA_OPTS" value="-Dspotfire.ocsp.use-local-proxy=false"/>
  </service>

Start the nodemanager service

Linux Node Manager

Shutdown the node manager service
Edit the <version>\nm\startup.sh file by adding the Java Option -Dspotfire.ocsp.use-local-proxy=false

exec "${JAVA_HOME}/bin/java" ${JAVA_OPTS} -Xmx256m 
-Dnm.home="${install_dir}/nm" -Djava.io.tmpdir="${install_dir}/nm/temp/nodemanager" 
-Dlog4j.configurationFile="${install_dir}/nm/config/log-config/log4j2.xml" 
-Dspotfire.ocsp.use-local-proxy=false
-Dlog4j.configurationFactory=com.spotfire.server.nodemanager.remote.NodeManagerConfigurationFactory
-classpath "${CLASSPATH}" com.spotfire.server.nodemanager.remote.JettyBox

Start the nodemanager service

Update Solidus handling on the Spotfire Server

Disable the local OCSP proxy

Related articles