Red Hat Product Errata RHSA-2025:13685 - Security Advisory
Issued:
2025-08-13
Updated:
2025-08-13

RHSA-2025:13685 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 6.1.2 release and security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Red Hat JBoss Web Server 6.1.2 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 6.1.2 serves as a replacement for Red Hat JBoss Web Server 6.1.1. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.

Security Fix(es):

  • jws6-tomcat: Apache Tomcat denial of service [jws-6] (CVE-2025-52520)
  • [Minor Incident] tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames [jws-6] (CVE-2025-48989)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 6 for RHEL 10 x86_64
  • JBoss Enterprise Web Server 6 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 6 for RHEL 8 x86_64

Fixes

  • BZ - 2373309 - CVE-2025-48989 tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames
  • BZ - 2379374 - CVE-2025-52520 tomcat: Apache Tomcat denial of service

JBoss Enterprise Web Server 6 for RHEL 10

SRPM
jws6-tomcat-10.1.36-8.redhat_00009.1.el10jws.src.rpm SHA-256: a1088fadce4742d3250bdf6c58edea18eb5d206f19a80eb036917644f64f71bc
x86_64
jws6-tomcat-10.1.36-8.redhat_00009.1.el10jws.noarch.rpm SHA-256: e2ebdf361ddd200751a5cb98ac6c86d907adcca1bad245a36c48df69944b9fa7
jws6-tomcat-admin-webapps-10.1.36-8.redhat_00009.1.el10jws.noarch.rpm SHA-256: c56ab3440ce7145766906b024b817fa0435295a7361ae3b5d82b69d0e82a8dc6
jws6-tomcat-docs-webapp-10.1.36-8.redhat_00009.1.el10jws.noarch.rpm SHA-256: 20c638a83578b7461eef704fcba534be2cd0a8053724681e7d1e3ff0e45cf198
jws6-tomcat-el-5.0-api-10.1.36-8.redhat_00009.1.el10jws.noarch.rpm SHA-256: 9a2813a7173a7f582d8780d8406e88497c9be67094669261cbf8a76d559a0a91
jws6-tomcat-javadoc-10.1.36-8.redhat_00009.1.el10jws.noarch.rpm SHA-256: bc91e303334ea737103e23b0f11eb6508b97fde88d16680f1677f02ea5a8b262
jws6-tomcat-jsp-3.1-api-10.1.36-8.redhat_00009.1.el10jws.noarch.rpm SHA-256: bc40451fd39fca27be000712558beb005aca6975601ca94da89457a9959f869d
jws6-tomcat-lib-10.1.36-8.redhat_00009.1.el10jws.noarch.rpm SHA-256: 68b79052d8aa5e9715023dbc7d9bff91f558983b9321030e946abe4219c5974c
jws6-tomcat-selinux-10.1.36-8.redhat_00009.1.el10jws.noarch.rpm SHA-256: 3406845a6cfa6b672e4fde146be6c8ab7e7bfefacf0b894ff005badd31a9b28b
jws6-tomcat-servlet-6.0-api-10.1.36-8.redhat_00009.1.el10jws.noarch.rpm SHA-256: 8d8c1990c83fa75e39868adadb10ccda838d04512ba55f1c2e205cd97e5df396
jws6-tomcat-webapps-10.1.36-8.redhat_00009.1.el10jws.noarch.rpm SHA-256: f6df218ee7f98350336b9e67cb0a8f58778e45f22f1a44d9b0caa9a7d27f3eca

JBoss Enterprise Web Server 6 for RHEL 9

SRPM
jws6-tomcat-10.1.36-8.redhat_00009.1.el9jws.src.rpm SHA-256: 657856960348679e54106c7c2c2f1cfd2c2d47b67e3acaf65b250ad358d74723
x86_64
jws6-tomcat-10.1.36-8.redhat_00009.1.el9jws.noarch.rpm SHA-256: a3ea00fa531a53d3b02cfcb0ed30fb55f5d84e2fd8983d2ca801fb529b61668e
jws6-tomcat-admin-webapps-10.1.36-8.redhat_00009.1.el9jws.noarch.rpm SHA-256: b583f7052c7ea3233db60c745f6c6df2cb8c46f6def33eb7cf409c2389f491a6
jws6-tomcat-docs-webapp-10.1.36-8.redhat_00009.1.el9jws.noarch.rpm SHA-256: 474403f4c19e31db28d9bfab47d170382be31c492cfcac57715ae6cc1773269a
jws6-tomcat-el-5.0-api-10.1.36-8.redhat_00009.1.el9jws.noarch.rpm SHA-256: 6bfdbb16e4acc6a984914fd3bbe852753544644f20b7fb9ad133e10b42484f4c
jws6-tomcat-javadoc-10.1.36-8.redhat_00009.1.el9jws.noarch.rpm SHA-256: 354df3939453fcaf3070768293e46c5d94fede039a269d70b24f145180db6b99
jws6-tomcat-jsp-3.1-api-10.1.36-8.redhat_00009.1.el9jws.noarch.rpm SHA-256: c174a070fc620af408997171dbb9ae34cbcedf0b1e3f0f971ee18d94196f624c
jws6-tomcat-lib-10.1.36-8.redhat_00009.1.el9jws.noarch.rpm SHA-256: 205cce6f87885f0b4171dc916cb1dd02bafb0921da4c35bbf270bc8931b3187f
jws6-tomcat-selinux-10.1.36-8.redhat_00009.1.el9jws.noarch.rpm SHA-256: a374d3d9cdc99a79018ec9e6cc496e9d67018913a72fc3d10acaf7fb29afbffb
jws6-tomcat-servlet-6.0-api-10.1.36-8.redhat_00009.1.el9jws.noarch.rpm SHA-256: bcd80ddf182a7ce21947ee837f7b1d9b5b1ebc48c75d3c281fca358e155063d1
jws6-tomcat-webapps-10.1.36-8.redhat_00009.1.el9jws.noarch.rpm SHA-256: 9feafe7e8b4a06765b7f30ab71c958d16e9b7e96b80b61c091c2525f7101ac91

JBoss Enterprise Web Server 6 for RHEL 8

SRPM
jws6-tomcat-10.1.36-8.redhat_00009.1.el8jws.src.rpm SHA-256: 35789ad3f8a6137513401765811bb4dcd4bf6592ce7b7eb9fd12b88365115585
x86_64
jws6-tomcat-10.1.36-8.redhat_00009.1.el8jws.noarch.rpm SHA-256: ff984798849c59ec6908e9b7f1cfd1c245401348c4a4a619872c938c90b94607
jws6-tomcat-admin-webapps-10.1.36-8.redhat_00009.1.el8jws.noarch.rpm SHA-256: b17d635b0ec54f60258a3ecce80925a59944c5ccffce0fb3631c67eecc820193
jws6-tomcat-docs-webapp-10.1.36-8.redhat_00009.1.el8jws.noarch.rpm SHA-256: 46e641f6c8bf915441c16c30cd0bf73051fca3e5d4db6e7df87253873bdf489a
jws6-tomcat-el-5.0-api-10.1.36-8.redhat_00009.1.el8jws.noarch.rpm SHA-256: 42377d9a888da26fd985b81eef592ad94512cea58ebea89acefaf27b1712f9ab
jws6-tomcat-javadoc-10.1.36-8.redhat_00009.1.el8jws.noarch.rpm SHA-256: 0eb00405f7c60a4b29a67c8fc9aea79975ed3e68308e77b698681dba643307e5
jws6-tomcat-jsp-3.1-api-10.1.36-8.redhat_00009.1.el8jws.noarch.rpm SHA-256: a94e245b4f1a42fdece7d8fdef7532553390ae13424191a60f367d670188e0aa
jws6-tomcat-lib-10.1.36-8.redhat_00009.1.el8jws.noarch.rpm SHA-256: d7ee7165d3d93a310112384c88e7cfbf197dc2ec47f802b1bdfc6f2392aee939
jws6-tomcat-selinux-10.1.36-8.redhat_00009.1.el8jws.noarch.rpm SHA-256: 5c171f93b3243c31231c802769917c6c2fe78e0062b8e134b642ff96651abd2d
jws6-tomcat-servlet-6.0-api-10.1.36-8.redhat_00009.1.el8jws.noarch.rpm SHA-256: 2168439e683c656cfb461938c5d0c28f9eaaa4d856bd02db3c6764773020fe6c
jws6-tomcat-webapps-10.1.36-8.redhat_00009.1.el8jws.noarch.rpm SHA-256: 808951efdd4fb4cd87c58ddd44edb0917ae07d5a3c00a5a6df65f1f0221228f4

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.