Upgrade bamboo because of Tomcat vulnerability but license expired.

[niraj]

Hello, I am currently using Bamboo server 7.2.4 and my license expired on May 2021.

I have to upgrade Bamboo or Tomcat to a later version because of the Tomcat vulnerability  CVE-2022-25762.

What are the options for me?

Which version can I upgrade to?

Can I upgrade even if the license is expired?

Can I create a new instance of my bamboo server by taking a backup of the AMI and spinning a new instance, and they try the upgrade process there?

Thanks

[Eduardo Alvarenga · Accepted solution]

Hello @niraj,

Welcome to Atlassian Community!

Bamboo requires a license that is valid up to the date of the release you intend to install. As you are running Bamboo 7.2.4, you are on a "Server license", meaning you will not be able to upgrade Bamboo to a version of Bamboo that was released after the license expired nor be entitled to support.

For dates and examples please check the following KB article:

• What happens when a Bamboo license expires

Cheers,

Eduardo Alvarenga
Atlassian Support APAC

--please don't forget to Accept the answer if the reply is helpful--