Red Hat Product Errata RHSA-2024:5695 - Security Advisory
Issued:
2024-08-21
Updated:
2024-10-10

RHSA-2024:5695 - Security Advisory

Synopsis

Important: tomcat security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for tomcat is now available for Red Hat Enterprise Linux 8.8 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Improper Handling of Exceptional Conditions (CVE-2024-34750)
  • tomcat: Denial of Service in Tomcat (CVE-2024-38286)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64

Fixes

  • BZ - 2295651 - CVE-2024-34750 tomcat: Improper Handling of Exceptional Conditions
  • BZ - 2314686 - CVE-2024-38286 tomcat: Denial of Service in Tomcat

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8

SRPM
tomcat-9.0.87-1.el8_8.3.src.rpm SHA-256: 32d95a0bacc2c46e772d05378bd8494e1f25ee5582e852c091506906616f533d
x86_64
tomcat-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 0a2bb73ad9647dde955c6b118b285f91f2bbf48e9d7b54d7f13e1bdd9c9bb040
tomcat-admin-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7910413cf726802113dbc243059a4cf8979467b481a037e2cb85434ed35b4e1b
tomcat-docs-webapp-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7940d5f8af1192a582f3e130b2757ddcbdecb4094336f1c144d529eb72166522
tomcat-el-3.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 099ae9cf6a6d8df786a46805de8a7f171fddc7adfa6122b7906635fcda9b7c53
tomcat-jsp-2.3-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: bb607f334a6df7cd0eb43d979cfe5ce5609c8383a9fc4859f80e187655de954a
tomcat-lib-9.0.87-1.el8_8.3.noarch.rpm SHA-256: c2f0f38254670244b4a1df360b4731fa998fc8317ecc370460fc5ba985f2261b
tomcat-servlet-4.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: f922afb9a1926ba0fca7ced8a95a4e2408a300d13c463cad40f88be292533fa8
tomcat-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 623e74b2729bc0192782e8634bc3413a216b54be855be1026ed9e1ede53f5837

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8

SRPM
tomcat-9.0.87-1.el8_8.3.src.rpm SHA-256: 32d95a0bacc2c46e772d05378bd8494e1f25ee5582e852c091506906616f533d
s390x
tomcat-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 0a2bb73ad9647dde955c6b118b285f91f2bbf48e9d7b54d7f13e1bdd9c9bb040
tomcat-admin-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7910413cf726802113dbc243059a4cf8979467b481a037e2cb85434ed35b4e1b
tomcat-docs-webapp-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7940d5f8af1192a582f3e130b2757ddcbdecb4094336f1c144d529eb72166522
tomcat-el-3.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 099ae9cf6a6d8df786a46805de8a7f171fddc7adfa6122b7906635fcda9b7c53
tomcat-jsp-2.3-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: bb607f334a6df7cd0eb43d979cfe5ce5609c8383a9fc4859f80e187655de954a
tomcat-lib-9.0.87-1.el8_8.3.noarch.rpm SHA-256: c2f0f38254670244b4a1df360b4731fa998fc8317ecc370460fc5ba985f2261b
tomcat-servlet-4.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: f922afb9a1926ba0fca7ced8a95a4e2408a300d13c463cad40f88be292533fa8
tomcat-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 623e74b2729bc0192782e8634bc3413a216b54be855be1026ed9e1ede53f5837

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8

SRPM
tomcat-9.0.87-1.el8_8.3.src.rpm SHA-256: 32d95a0bacc2c46e772d05378bd8494e1f25ee5582e852c091506906616f533d
ppc64le
tomcat-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 0a2bb73ad9647dde955c6b118b285f91f2bbf48e9d7b54d7f13e1bdd9c9bb040
tomcat-admin-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7910413cf726802113dbc243059a4cf8979467b481a037e2cb85434ed35b4e1b
tomcat-docs-webapp-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7940d5f8af1192a582f3e130b2757ddcbdecb4094336f1c144d529eb72166522
tomcat-el-3.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 099ae9cf6a6d8df786a46805de8a7f171fddc7adfa6122b7906635fcda9b7c53
tomcat-jsp-2.3-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: bb607f334a6df7cd0eb43d979cfe5ce5609c8383a9fc4859f80e187655de954a
tomcat-lib-9.0.87-1.el8_8.3.noarch.rpm SHA-256: c2f0f38254670244b4a1df360b4731fa998fc8317ecc370460fc5ba985f2261b
tomcat-servlet-4.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: f922afb9a1926ba0fca7ced8a95a4e2408a300d13c463cad40f88be292533fa8
tomcat-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 623e74b2729bc0192782e8634bc3413a216b54be855be1026ed9e1ede53f5837

Red Hat Enterprise Linux Server - TUS 8.8

SRPM
tomcat-9.0.87-1.el8_8.3.src.rpm SHA-256: 32d95a0bacc2c46e772d05378bd8494e1f25ee5582e852c091506906616f533d
x86_64
tomcat-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 0a2bb73ad9647dde955c6b118b285f91f2bbf48e9d7b54d7f13e1bdd9c9bb040
tomcat-admin-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7910413cf726802113dbc243059a4cf8979467b481a037e2cb85434ed35b4e1b
tomcat-docs-webapp-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7940d5f8af1192a582f3e130b2757ddcbdecb4094336f1c144d529eb72166522
tomcat-el-3.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 099ae9cf6a6d8df786a46805de8a7f171fddc7adfa6122b7906635fcda9b7c53
tomcat-jsp-2.3-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: bb607f334a6df7cd0eb43d979cfe5ce5609c8383a9fc4859f80e187655de954a
tomcat-lib-9.0.87-1.el8_8.3.noarch.rpm SHA-256: c2f0f38254670244b4a1df360b4731fa998fc8317ecc370460fc5ba985f2261b
tomcat-servlet-4.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: f922afb9a1926ba0fca7ced8a95a4e2408a300d13c463cad40f88be292533fa8
tomcat-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 623e74b2729bc0192782e8634bc3413a216b54be855be1026ed9e1ede53f5837

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8

SRPM
tomcat-9.0.87-1.el8_8.3.src.rpm SHA-256: 32d95a0bacc2c46e772d05378bd8494e1f25ee5582e852c091506906616f533d
aarch64
tomcat-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 0a2bb73ad9647dde955c6b118b285f91f2bbf48e9d7b54d7f13e1bdd9c9bb040
tomcat-admin-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7910413cf726802113dbc243059a4cf8979467b481a037e2cb85434ed35b4e1b
tomcat-docs-webapp-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7940d5f8af1192a582f3e130b2757ddcbdecb4094336f1c144d529eb72166522
tomcat-el-3.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 099ae9cf6a6d8df786a46805de8a7f171fddc7adfa6122b7906635fcda9b7c53
tomcat-jsp-2.3-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: bb607f334a6df7cd0eb43d979cfe5ce5609c8383a9fc4859f80e187655de954a
tomcat-lib-9.0.87-1.el8_8.3.noarch.rpm SHA-256: c2f0f38254670244b4a1df360b4731fa998fc8317ecc370460fc5ba985f2261b
tomcat-servlet-4.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: f922afb9a1926ba0fca7ced8a95a4e2408a300d13c463cad40f88be292533fa8
tomcat-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 623e74b2729bc0192782e8634bc3413a216b54be855be1026ed9e1ede53f5837

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8

SRPM
tomcat-9.0.87-1.el8_8.3.src.rpm SHA-256: 32d95a0bacc2c46e772d05378bd8494e1f25ee5582e852c091506906616f533d
ppc64le
tomcat-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 0a2bb73ad9647dde955c6b118b285f91f2bbf48e9d7b54d7f13e1bdd9c9bb040
tomcat-admin-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7910413cf726802113dbc243059a4cf8979467b481a037e2cb85434ed35b4e1b
tomcat-docs-webapp-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7940d5f8af1192a582f3e130b2757ddcbdecb4094336f1c144d529eb72166522
tomcat-el-3.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 099ae9cf6a6d8df786a46805de8a7f171fddc7adfa6122b7906635fcda9b7c53
tomcat-jsp-2.3-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: bb607f334a6df7cd0eb43d979cfe5ce5609c8383a9fc4859f80e187655de954a
tomcat-lib-9.0.87-1.el8_8.3.noarch.rpm SHA-256: c2f0f38254670244b4a1df360b4731fa998fc8317ecc370460fc5ba985f2261b
tomcat-servlet-4.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: f922afb9a1926ba0fca7ced8a95a4e2408a300d13c463cad40f88be292533fa8
tomcat-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 623e74b2729bc0192782e8634bc3413a216b54be855be1026ed9e1ede53f5837

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8

SRPM
tomcat-9.0.87-1.el8_8.3.src.rpm SHA-256: 32d95a0bacc2c46e772d05378bd8494e1f25ee5582e852c091506906616f533d
x86_64
tomcat-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 0a2bb73ad9647dde955c6b118b285f91f2bbf48e9d7b54d7f13e1bdd9c9bb040
tomcat-admin-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7910413cf726802113dbc243059a4cf8979467b481a037e2cb85434ed35b4e1b
tomcat-docs-webapp-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 7940d5f8af1192a582f3e130b2757ddcbdecb4094336f1c144d529eb72166522
tomcat-el-3.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 099ae9cf6a6d8df786a46805de8a7f171fddc7adfa6122b7906635fcda9b7c53
tomcat-jsp-2.3-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: bb607f334a6df7cd0eb43d979cfe5ce5609c8383a9fc4859f80e187655de954a
tomcat-lib-9.0.87-1.el8_8.3.noarch.rpm SHA-256: c2f0f38254670244b4a1df360b4731fa998fc8317ecc370460fc5ba985f2261b
tomcat-servlet-4.0-api-9.0.87-1.el8_8.3.noarch.rpm SHA-256: f922afb9a1926ba0fca7ced8a95a4e2408a300d13c463cad40f88be292533fa8
tomcat-webapps-9.0.87-1.el8_8.3.noarch.rpm SHA-256: 623e74b2729bc0192782e8634bc3413a216b54be855be1026ed9e1ede53f5837

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.