Upgrade Tomcat to fix CVE-2023-28709

h3. Issue summary

Apache Tomcat should be upgraded to 8.5.88 and 9.0.74 or a later version to fix [CVE-2023-28709|https://nvd.nist.gov/vuln/detail/CVE-2023-28709]
h3. Environment

• Bamboo 8, 9

h3. Steps to Reproduce

• Check the Apache Tomcat version on {{pom.xml}} or {{<bamboo-install>/bin/version.sh/bat}}

h3. Expected Results

• Bamboo 8.x: apache-tomcat 8.5.88 and later
• Bamboo 9.x: apache-tomcat 9.0.74 and later

h3. Actual Results

• Bamboo 8.x: apache-tomcat 8.5.87 and earlier
• Bamboo 9.x: apache-tomcat-9.0.73 and earlier

h3. Workaround

At your own risk, you can manually upgrade Tomcat as instructed on this KB:

• [How to upgrade Apache Tomcat version used by Bamboo|https://confluence.atlassian.com/bamkb/how-to-upgrade-apache-tomcat-version-used-by-bamboo-1115656288.html]

{}WARNING{}: Unless still reproducible on official releases, Atlassian Support may refuse support requests for Bamboo running over unofficial Tomcat versions.