This is a 2-part question.  I'm currently running 4.2.3.GA with an updated jbossweb jar from 2.0.0.GA.CP15 tag.   I would like to know if my server is vulnerable with the latest security issues and what version of jbossweb I can get to help me.  Looking at https://community.jboss.org/wiki/VersionOfTomcatInJBossAS, I need to get the latest jbossweb 2.0.1 version which is 2.0.1.GA found here: http://anonsvn.jboss.org/repos/jbossweb/tags/.  Is this correct, as far as getting the latest version of jbossweb for 4.2.3.GA?

In IAVM 2011-B-0148, multiple security vulnerabilities were addressed by tomcat and the fix is to update to the latest tomcat 6.0.35.  Seeing that jbossweb is forked from tomcat, how do I know if I'm vulnerable or not to these issues?  How do security vulnerabilities get addressed in jbossweb and isn't there a list that I can go to that shows this info?

Thanks,

Dan