...
Tomcat (required for the deployment of the Admin Interface, the Archive Server and the Database HTTPS Proxy) is installed separately (by the organization). Deltares indicates which version of tomcat is compatible with / required for which version of Delft-FEWS. All security related aspects available in Tomcat can be applied and are under the responsibility of the organization.
For Admin Interface clients / proxies that are exposed to the internet it is crucial that the highest/securest version of Tomcat is used. The highest version most commonly contains security fixes of common vulnerabilities and exposures (CVEs). Any version of our Admin Interface / HttpProxy / ArchiveServer can (in general) always be made to work as long as the correct Java version is used.
See http://tomcat.apache.org/security-9.html
JRE/Java
In several components of Delft-FEWS a (stripped down) version of Java/JRE (Java Runtime Environment) is embedded. This JRE folder is a recognizable and standard part of the Delft-FEWS binary package for Operator Clients and Forecasting Shell Servers. This means that Deltares delivers an optimized (and minimal) Java Runtime Edition based on Amazon Corretto's series. This so-called base-build can be updated and Deltares will release new base-builds if required. Since the JRE folder is recognizable within the Delft-FEWS binaries, organizations may decide to replace this folder with another (compatible) version of the JRE but could originate from a different provider (e.g. Oracle Sun).
...