RHSA-2025:7497
Vulnerability from csaf_redhat - Published: 2025-05-13 16:02 - Updated: 2026-09-28 09:38Summary
Red Hat Security Advisory: tomcat security update
Severity
Moderate
Notes
Topic: An update for tomcat is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)
* tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)
* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL.
6.1 (Medium)
Affected products
Fixed
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. Tomcat may skip, after an error, the recycling of the internal objects that the next request/response process might use, resulting in information leaking from one request to the next. This flaw allows a malicious user to have access to this information.
5.3 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2023-41080
Threats
Impact
Moderate
A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as 'Important' as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit. CVE-2023-39325 was assigned for the Rapid Reset Attack in the Go language packages. Security Bulletin https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2023-41080
Threats
Exploit Status
CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Impact
Important
A flaw was found in Apache Tomcat, where an improper input validation can occur. This flaw allows a malicious user to send a crafted request containing an invalid trailer header, which could be treated as multiple requests, potentially leading to request smuggling when behind a reverse proxy.
5.3 (Medium)
Affected products
Fixed
9 products, the same list as for
CVE-2023-41080
Threats
Impact
Moderate
An improper Input validation flaw was found in Apache Tomcat due to incorrect parsing of HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests, leading to the possibility of request smuggling when behind a reverse proxy.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2023-41080
Threats
Impact
Important
A denial of service (DoS) vulnerability present in the Apache Tomcat package arises from an incomplete cleanup process. Specifically, WebSocket clients can perpetuate WebSocket connections without proper termination, thereby causing a sustained drain on system resources. This vulnerability facilitates the exploitation of Apache Tomcat servers, leading to a scenario where excessive resource consumption occurs due to the prolonged existence of these open WebSocket connections. As a consequence, the server's performance may degrade significantly, resulting in potential service disruption or unresponsiveness.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2023-41080
Threats
Impact
Important
A vulnerability was found in the Tomcat package due to its handling of HTTP/2 requests. Specifically, when an HTTP/2 request surpasses the predetermined limits for headers configured within the server, the associated HTTP/2 stream isn't reset immediately. Instead, the reset action occurs only after all the headers within the request have been processed. This lapse in resetting the stream exposes the system to potential risks, as it allows malicious actors to exploit the delay in stream reset to carry out various attacks, such as header manipulation or resource exhaustion.
7.5 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2023-41080
Threats
Impact
Important
A flaw was found in Apache Tomcat when configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component. This vulnerability allows authentication bypass via improperly handled exceptions during the authentication process.
7.4 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2023-41080
Threats
Impact
Low
A flaw was found in the "examples" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory (OOM) error, leading to a denial of service.
CWE-400 - Uncontrolled Resource ConsumptionAffected products
Fixed
9 products, the same list as for
CVE-2023-41080
Threats
Impact
Low
The fix for CVE-2024-50379 in Apache Tomcat was insufficient to mitigate the issue fully. A Time-of-check Time-of-use (TOCTOU) race condition occurs during JSP compilation on case-insensitive file systems when the default servlet is enabled for writing. This vulnerability allows an uploaded file to be treated as a JSP and executed, resulting in remote code execution.
8.1 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2023-41080
Threats
Impact
Moderate
A flaw was found in Apache Tomcat. In certain conditions and configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and add malicious content via a write-enabled Default Servlet in Apache Tomcat. For the vulnerability to be exploited, the following conditions must be true: writes to the default servlet are enabled (disabled by default), sensitive file uploads are sub-directories of a target URL for public uploads, attackers know the names of the files, and those files are subject to partial PUT uploads enabled by default. If an application uses file-based session persistence with default storage and includes exploitable libraries, remote code execution (RCE) is possible.
8.6 (High)
Affected products
Fixed
9 products, the same list as for
CVE-2023-41080
Threats
Exploit Status
CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Impact
Moderate
References
70 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for tomcat is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)\n\n* tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)\n\n* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:7497",
"url": "https://access.redhat.com/errata/RHSA-2025:7497"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "2326972",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2326972"
},
{
"category": "external",
"summary": "2332815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332815"
},
{
"category": "external",
"summary": "2351129",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2351129"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7497.json"
}
],
"title": "Red Hat Security Advisory: tomcat security update",
"tracking": {
"current_release_date": "2026-09-28T09:38:19+00:00",
"generator": {
"date": "2026-09-28T09:38:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2025:7497",
"initial_release_date": "2025-05-13T16:02:30+00:00",
"revision_history": [
{
"date": "2025-05-13T16:02:30+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-05-13T16:02:30+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-28T09:38:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-1:10.1.36-1.el10_0.src",
"product": {
"name": "tomcat-1:10.1.36-1.el10_0.src",
"product_id": "tomcat-1:10.1.36-1.el10_0.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat@10.1.36-1.el10_0?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "tomcat-1:10.1.36-1.el10_0.noarch",
"product": {
"name": "tomcat-1:10.1.36-1.el10_0.noarch",
"product_id": "tomcat-1:10.1.36-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"product": {
"name": "tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"product_id": "tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-admin-webapps@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"product": {
"name": "tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"product_id": "tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-docs-webapp@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"product": {
"name": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"product_id": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-el-5.0-api@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"product": {
"name": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"product_id": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-jsp-3.1-api@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-lib-1:10.1.36-1.el10_0.noarch",
"product": {
"name": "tomcat-lib-1:10.1.36-1.el10_0.noarch",
"product_id": "tomcat-lib-1:10.1.36-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-lib@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"product": {
"name": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"product_id": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-servlet-6.0-api@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "tomcat-webapps-1:10.1.36-1.el10_0.noarch",
"product": {
"name": "tomcat-webapps-1:10.1.36-1.el10_0.noarch",
"product_id": "tomcat-webapps-1:10.1.36-1.el10_0.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/tomcat-webapps@10.1.36-1.el10_0?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch"
},
"product_reference": "tomcat-1:10.1.36-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-1:10.1.36-1.el10_0.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src"
},
"product_reference": "tomcat-1:10.1.36-1.el10_0.src",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch"
},
"product_reference": "tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch"
},
"product_reference": "tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch"
},
"product_reference": "tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch"
},
"product_reference": "tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-lib-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch"
},
"product_reference": "tomcat-lib-1:10.1.36-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch"
},
"product_reference": "tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "tomcat-webapps-1:10.1.36-1.el10_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
},
"product_reference": "tomcat-webapps-1:10.1.36-1.el10_0.noarch",
"relates_to_product_reference": "AppStream-10.0.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-41080",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"discovery_date": "2023-08-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2235370"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Open Redirect vulnerability in FORM authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The pki-servlet-engine package has been obsoleted by the Tomcat package. Therefore, this issue will be fixed in the Tomcat package rather than the pki-serlvet-engine package. Please follow the RHEL Tomcat trackers instead for the updates.\n\nRed Hat Satellite is not directly impacted by this issue, since it does not embed the dependency on their offer deliveries. However, end users of Red Hat Satellite are using Tomcat via RHEL channels, which provides Tomcat dependency needed by candlepin to function in Satellite.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-41080"
},
{
"category": "external",
"summary": "RHBZ#2235370",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2235370"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-41080",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41080"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-41080",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41080"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f",
"url": "https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f"
}
],
"release_date": "2023-08-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T16:02:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7497"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Open Redirect vulnerability in FORM authentication"
},
{
"cve": "CVE-2023-42795",
"cwe": {
"id": "CWE-459",
"name": "Incomplete Cleanup"
},
"discovery_date": "2023-10-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2243752"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. Tomcat may skip, after an error, the recycling of the internal objects that the next request/response process might use, resulting in information leaking from one request to the next. This flaw allows a malicious user to have access to this information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: improper cleaning of recycled objects could lead to information leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as a Moderate impact as the confidentiality is not fully compromised and the malicious user does not have confirmation over the scenario to replicate the error and capture the possible jeopardizing response.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-42795"
},
{
"category": "external",
"summary": "RHBZ#2243752",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243752"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-42795",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-42795"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42795"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2023/10/10/9",
"url": "http://www.openwall.com/lists/oss-security/2023/10/10/9"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw",
"url": "https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw"
}
],
"release_date": "2023-10-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T16:02:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7497"
},
{
"category": "workaround",
"details": "No mitigation is currently available for this flaw.",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: improper cleaning of recycled objects could lead to information leak"
},
{
"cve": "CVE-2023-44487",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-10-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2242803"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RST_STREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any server-side limit for the maximum number of active streams per connection, resulting in a denial of service due to server resource consumption. Red Hat has rated the severity of this flaw as \u0027Important\u0027 as the US Cybersecurity and Infrastructure Security Agency (CISA) declared this vulnerability an active exploit.\r\n\r\nCVE-2023-39325 was assigned for the Rapid Reset Attack in the Go language packages.\r\n\r\nSecurity Bulletin\r\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2023-003",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "NGINX has been marked as Moderate Impact because, for performance and resource consumption reasons, NGINX limits the number of concurrent streams to a default of 128. In addition, to optimally balance network and server performance, NGINX allows the client to persist HTTP connections for up to 1000 requests by default using an HTTP keepalive.\n\nThe majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a \"Moderate\" level of impact.\n\nrhc component is no longer impacted by CVE-2023-44487 \u0026 CVE-2023-39325.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-44487"
},
{
"category": "external",
"summary": "RHBZ#2242803",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2242803"
},
{
"category": "external",
"summary": "RHSB-2023-003",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2023-003"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487"
},
{
"category": "external",
"summary": "https://github.com/dotnet/announcements/issues/277",
"url": "https://github.com/dotnet/announcements/issues/277"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2023-2102",
"url": "https://pkg.go.dev/vuln/GO-2023-2102"
},
{
"category": "external",
"summary": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
"url": "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"
},
{
"category": "external",
"summary": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
"url": "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2023-10-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T16:02:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7497"
},
{
"category": "workaround",
"details": "Users are strongly urged to update their software as soon as fixes are available. \nThere are several mitigation approaches for this flaw. \n\n1. If circumstances permit, users may disable http2 endpoints to circumvent the flaw altogether until a fix is available.\n2. IP-based blocking or flood protection and rate control tools may be used at network endpoints to filter incoming traffic.\n3. Several package specific mitigations are also available. \n a. nginx: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/\n b. netty: https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p\n c. haproxy: https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487\n d. nghttp2: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg\n e. golang: The default stream concurrency limit in golang is 250 streams (requests) per HTTP/2 connection. This value may be adjusted in the golang.org/x/net/http2 package using the Server.MaxConcurrentStreams setting and the ConfigureServer function which are available in golang.org/x/net/http2.",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2023-10-10T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Important"
}
],
"title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)"
},
{
"cve": "CVE-2023-45648",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2023-10-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2243749"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat, where an improper input validation can occur. This flaw allows a malicious user to send a crafted request containing an invalid trailer header, which could be treated as multiple requests, potentially leading to request smuggling when behind a reverse proxy.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: incorrectly parsed http trailer headers can cause request smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The request smuggling is not guaranteed to have relevant information within every request and the scenario behind a reverse proxy which fails to handle the request too is necessary, hence the Moderate impact.\n\nThe Red Hat AMQ Broker team removed any tomcat dependencies in version 7.11.3. Please refer to https://errata.devel.redhat.com/advisory/121941.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-45648"
},
{
"category": "external",
"summary": "RHBZ#2243749",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243749"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-45648",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45648"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45648",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45648"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2023/10/10/10",
"url": "http://www.openwall.com/lists/oss-security/2023/10/10/10"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp",
"url": "https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp"
}
],
"release_date": "2023-10-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T16:02:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7497"
},
{
"category": "workaround",
"details": "No mitigation is currently available for this flaw.",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: incorrectly parsed http trailer headers can cause request smuggling"
},
{
"cve": "CVE-2023-46589",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2023-11-29T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2252050"
}
],
"notes": [
{
"category": "description",
"text": "An improper Input validation flaw was found in Apache Tomcat due to incorrect parsing of HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests, leading to the possibility of request smuggling when behind a reverse proxy.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: HTTP request smuggling via malformed trailer headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in Apache Tomcat is of significant importance due to its potential to exploit HTTP request smuggling, presenting a security risk for web applications utilizing Tomcat. The flaw arises from Tomcat\u0027s improper parsing of HTTP trailer headers, where a specifically crafted header exceeding the size limit could cause Tomcat to treat a single request as multiple ones. This opens the door for attackers to manipulate requests and potentially conduct various malicious activities, such as unauthorized access, data exposure, or other exploits, particularly when Tomcat is deployed behind a reverse proxy. \n\nThe pki-servlet-engine package has been obsoleted by the Tomcat package. Therefore, this issue will be fixed in the Tomcat package rather than the pki-serlvet-engine package. Please follow the RHEL Tomcat trackers instead for the updates.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-46589"
},
{
"category": "external",
"summary": "RHBZ#2252050",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2252050"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-46589",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-46589"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-46589",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46589"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2023/11/28/2",
"url": "http://www.openwall.com/lists/oss-security/2023/11/28/2"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/0rqq6ktozqc42ro8hhxdmmdjm1k1tpxr",
"url": "https://lists.apache.org/thread/0rqq6ktozqc42ro8hhxdmmdjm1k1tpxr"
}
],
"release_date": "2023-11-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T16:02:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7497"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tomcat: HTTP request smuggling via malformed trailer headers"
},
{
"cve": "CVE-2024-23672",
"cwe": {
"id": "CWE-459",
"name": "Incomplete Cleanup"
},
"discovery_date": "2024-03-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2269608"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service (DoS) vulnerability present in the Apache Tomcat package arises from an incomplete cleanup process. Specifically, WebSocket clients can perpetuate WebSocket connections without proper termination, thereby causing a sustained drain on system resources. This vulnerability facilitates the exploitation of Apache Tomcat servers, leading to a scenario where excessive resource consumption occurs due to the prolonged existence of these open WebSocket connections. As a consequence, the server\u0027s performance may degrade significantly, resulting in potential service disruption or unresponsiveness.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat: WebSocket DoS with incomplete closing handshake",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Denial of Service (DoS) vulnerability within the Apache Tomcat package represents an Important severity issue due to its potential to significantly impact system availability and performance. By allowing WebSocket clients to maintain open connections without proper cleanup, the vulnerability facilitates the sustained consumption of server resources. This exploitation results in increased CPU, memory, and network utilization, ultimately leading to server degradation or unresponsiveness. The inability to terminate these lingering connections efficiently exacerbates the severity of the issue, as it enables attackers to exploit limited resources over an extended period, amplifying the impact of the attack.\n\nRed Hat Certificate System 10.0 as well as Red Hat Enterprise Linux 8\u0027s Identity Management, are using a vulnerable version of Tomcat, bundled into the pki-servlet-engine component. However, there are no entry point for WebSockets, and thus it is not possible to trigger the flaw in a supported setup.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-23672"
},
{
"category": "external",
"summary": "RHBZ#2269608",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269608"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-23672",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-23672"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23672"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f",
"url": "https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f"
}
],
"release_date": "2024-03-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T16:02:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7497"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Tomcat: WebSocket DoS with incomplete closing handshake"
},
{
"cve": "CVE-2024-24549",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2024-03-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2269607"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in the Tomcat package due to its handling of HTTP/2 requests. Specifically, when an HTTP/2 request surpasses the predetermined limits for headers configured within the server, the associated HTTP/2 stream isn\u0027t reset immediately. Instead, the reset action occurs only after all the headers within the request have been processed. This lapse in resetting the stream exposes the system to potential risks, as it allows malicious actors to exploit the delay in stream reset to carry out various attacks, such as header manipulation or resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Tomcat: HTTP/2 header handling DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability presents an Important severity issue due to its potential to facilitate various forms of attack, particularly in the context of HTTP/2 protocol. By delaying the reset of HTTP/2 streams until after processing all headers, malicious actors can exploit this window to execute header manipulation attacks, leading to potential data exfiltration, injection of malicious content, or server resource exhaustion. Furthermore, the delayed reset prolongs the exposure time of vulnerable systems, increasing the likelihood of successful exploitation.\n\nIn addition, Red Hat Certificate System 10.0 and Red Hat Enterprise Linux 8\u0027s Identity Management, are using a vulnerable version of Tomcat that is bundled into the pki-servlet-engine component. However, HTTP/2 is not enabled in such a configuration, and it is not possible to trigger the flaw in a supported setup. See https://access.redhat.com/security/cve/CVE-2020-13934 for context.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-24549"
},
{
"category": "external",
"summary": "RHBZ#2269607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2269607"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-24549",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24549"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24549"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg",
"url": "https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg"
}
],
"release_date": "2024-03-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T16:02:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7497"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Tomcat: HTTP/2 header handling DoS"
},
{
"cve": "CVE-2024-52316",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2024-11-18T12:00:54.223330+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2326972"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat when configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component. This vulnerability allows authentication bypass via improperly handled exceptions during the authentication process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has assessed this flaw at Attack Complexity as High, and impact metrics Confidentiality and Integrity as High, with a resultant base flaw Security Impact of Important. However, the factors involved in successful exploitation--usage of a custom Jakarta ServerAuthContext component, possible mishandling of exception management in that custom component, and failure in such a way as to allow a failed authentication to proceed in that exception mishandling--are sufficiently unlikely, such that Apache determined the impact to be Low. While Red Hat concurs with the worst-case assessment of Important for the base flaw, all products are assessed as Low, per individual risk assessment and in concurrence with Apache\u0027s rating.\n\nRed Hat Satellite is not directly impacted by this issue as it does not include the affected Tomcat package. However, Tomcat is consumed by Candlepin, a component of Satellite. Red Hat Satellite users are advised to check the impact state of Red Hat Enterprise Linux as any necessary fixes will be distributed through the platform.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-52316"
},
{
"category": "external",
"summary": "RHBZ#2326972",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2326972"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-52316",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-52316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52316"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928",
"url": "https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928"
}
],
"release_date": "2024-11-18T11:32:22.072000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T16:02:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7497"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API"
},
{
"cve": "CVE-2024-54677",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2024-12-17T13:00:41.984822+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2332815"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the \"examples\" web application of Apache Tomcat. Numerous examples within that application did not place limits on uploaded data. This vulnerability can potentially trigger an out-of-memory (OOM) error, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Apache Tomcat: DoS in examples web application",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "By default, the examples web application is only accessible to the localhost.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-54677"
},
{
"category": "external",
"summary": "RHBZ#2332815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-54677",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-54677"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-54677",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54677"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n",
"url": "https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n"
}
],
"release_date": "2024-12-17T12:35:50.948000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T16:02:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7497"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "tomcat: Apache Tomcat: DoS in examples web application"
},
{
"cve": "CVE-2024-56337",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2024-12-20T16:00:45.883126+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2333521"
}
],
"notes": [
{
"category": "description",
"text": "The fix for CVE-2024-50379 in Apache Tomcat was insufficient to mitigate the issue fully. A Time-of-check Time-of-use (TOCTOU) race condition occurs during JSP compilation on case-insensitive file systems when the default servlet is enabled for writing. This vulnerability allows an uploaded file to be treated as a JSP and executed, resulting in remote code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The vulnerability is marked as moderate rather than important due to the specific conditions required for exploitation. For the attack to succeed, the server must be running on a case-insensitive file system (e.g., Windows or macOS) and have the default servlet enabled with write permissions \u2014a configuration that is not common in production-grade environments. Additionally, the attacker must gain the ability to upload files to a writable directory and exploit a race condition to execute them as JSP files, which introduces a level of complexity and timing dependency.\n\nThe pki-servlet-engine package has been obsoleted by the tomcat package as of Red Hat Enterprise Linux 8.9 so no fixes for the servlet engine would be made available.\n\nAlthough Red Hat Satellite Server\u2014 via its Candlepin component\u2014 employs the use of Tomcat, Satellite is itself not considered Affected. Satellite does not provide the Tomcat package\u2014 it is inherited from the underlying RHEL Operating System. Users of Red Hat Satellite are advised to refer to the impact state of the Tomcat package provided by the version of RHEL underpinning the Satellite Server instance, as any errata will be provided via RHEL Application Stream repositories.\n \nIt should be noted that a successful attack requires the server be running on a case-insensitive file system. As Satellite only runs on RHEL\u2014 and RHEL employs case-sensitive filesystems by default\u2014 a typical Satellite server instance is not vulnerable. Additionally, a successful attack also requires the server have the default servlet enabled with write permissions\u2013 a condition which does not exist in a default Satellite deployment. Again, a typical Satellite server instance is not vulnerable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-56337"
},
{
"category": "external",
"summary": "RHBZ#2333521",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333521"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-56337",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56337"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56337",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56337"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp",
"url": "https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-50379",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-50379"
}
],
"release_date": "2024-12-20T15:28:54.738000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T16:02:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7497"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation"
},
{
"cve": "CVE-2025-24813",
"cwe": {
"id": "CWE-41",
"name": "Improper Resolution of Path Equivalence"
},
"discovery_date": "2025-03-10T17:00:47.696071+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2351129"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. In certain conditions and configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and add malicious content via a write-enabled\u00a0Default Servlet\u00a0in Apache Tomcat. \n\nFor the vulnerability to be exploited, the following conditions must be true: writes to the default servlet are enabled (disabled by default), sensitive file uploads are sub-directories of a target URL for public uploads, attackers know the names of the files, and those files are subject to partial PUT uploads enabled by default. If an application uses file-based session persistence with default storage and includes exploitable libraries, remote code execution (RCE) is possible.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has a Moderate impact (rather than Important) because it requires multiple non-default configurations to be exploitable, significantly limiting its impact in typical deployments. For remote code execution (RCE), exploitation requires both file-based session persistence and a library vulnerable to deserialization, further reducing its likelihood. For information disclosure or file injection, the attack is only possible if writes are enabled for the default servlet, partial PUT requests are supported, and sensitive file uploads occur within a publicly writable directory. The combination of all three of these conditions is uncommon in secure environments. Since most modern Tomcat deployments do not meet all these criteria simultaneously, the overall risk is reduced\n\nThe Tomcat package as shipped in Red Hat Enterprise Linux 6 and 7 is not affected by this vulnerability because the vulnerable code was introduced in a newer Tomcat version.\n\nRed Hat Satellite is not directly impacted by this issue as it does not include the affected Tomcat package. However, Tomcat is consumed by Candlepin, a component of Satellite. Red Hat Satellite users are advised to check the impact state of Red Hat Enterprise Linux as any necessary fixes will be distributed through the platform. Satellite configuration does not contain affected parameters that would make Tomcat vulnerable, therefore, even if a vulnerable Tomcat version is shipped with affected RHEL release alongside Satellite, there is no chance of it being exposed to flaw in Red Hat Satellite.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-24813"
},
{
"category": "external",
"summary": "RHBZ#2351129",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2351129"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-24813",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-24813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24813"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq",
"url": "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2025-03-10T16:44:03.715000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-13T16:02:30+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:7497"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-1:10.1.36-1.el10_0.src",
"AppStream-10.0.Z:tomcat-admin-webapps-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-docs-webapp-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-el-5.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-jsp-3.1-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-lib-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-servlet-6.0-api-1:10.1.36-1.el10_0.noarch",
"AppStream-10.0.Z:tomcat-webapps-1:10.1.36-1.el10_0.noarch"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2025-04-01T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…