Thank you for the link to the Tomcat patch repository however I did not see the exact version that I was looking for.
I am using JBoss 4.0.5GA which shipped with JBoss Tomcat 5.5.20 and my customer is requiring me to upgrade Tomcat to 5.5.28. Can you provide me the instructions to replace the bundled JBoss Tomcat 5.5.20 with the new Tomcat release 5.5.28?
For our customers we don't replace the bundled 5.5.23 (or 20) by a 5.5.28 but we use the code in the repository. The repository contains all security patches to be as safe as a 5.5.28 Tomcat (and have be tested).
If you really want to use 5.5.28 just build it and replace the jar files in your AS installation. Note that is not what JBoss supports so you may ended in troubles....