FIS 2.0 CVE Status

Issue

• We are on FIS version https://maven.repository.redhat.com/ga/io/fabric8/fabric8-project-bom-camel-spring-boot/2.2.170.redhat-000019/
• It comes with tomcat version 8.0.36.redhat-24.
• Security has come up with the following CVE list. Are these fixed in the version we are using ?
• This will potentially hold up go-live.

https://www.cvedetails.com/cve/CVE-2016-8735/
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports

https://www.cvedetails.com/cve/CVE-2017-12617/
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

https://access.redhat.com/security/cve/cve-2017-5929