Red Hat Product Errata RHSA-2025:19809 - Security Advisory
Issued:
2025-11-06
Updated:
2025-11-06

RHSA-2025:19809 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 6.1.3 release and security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Red Hat JBoss Web Server 6.1.3 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 6.1.3 serves as a replacement for Red Hat JBoss Web Server 6.1.2. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.

Security Fix(es):

  • tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE [jws-6] (CVE-2025-55752)
  • tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve [jws-6] (CVE-2025-31651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 6 for RHEL 10 x86_64
  • JBoss Enterprise Web Server 6 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 6 for RHEL 8 x86_64

Fixes

  • BZ - 2362782 - CVE-2025-31651 tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve
  • BZ - 2406591 - CVE-2025-55752 tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE
  • JWS-3618 - Fix a race condition in the handling of HTTP/2 stream reset that could cause unexpected 500 responses.

JBoss Enterprise Web Server 6 for RHEL 10

SRPM
jws6-tomcat-10.1.36-19.redhat_00018.1.el10jws.src.rpm SHA-256: 52bed7c9b98292ba57ec1def8ace79fb5d729d2148a91ba877da3f6d8de13ebc
x86_64
jws6-tomcat-10.1.36-19.redhat_00018.1.el10jws.noarch.rpm SHA-256: e93b7c875bf97c6c55d915314f8bbaaa345f91fd014d88b89139807bfa36e3e1
jws6-tomcat-admin-webapps-10.1.36-19.redhat_00018.1.el10jws.noarch.rpm SHA-256: e0762c2c3e9cfa5f38f32fe5b9bb857f47f75176ce2e00182919381ad0203056
jws6-tomcat-docs-webapp-10.1.36-19.redhat_00018.1.el10jws.noarch.rpm SHA-256: 7c182aa6ba144a11a836c9c236226e5c326a6acd33284f33652784633fda6aa9
jws6-tomcat-el-5.0-api-10.1.36-19.redhat_00018.1.el10jws.noarch.rpm SHA-256: 90bc91e5e2193ff32bc2d37cdb38fe94cb09e99973009072c83afc8e569a5db2
jws6-tomcat-javadoc-10.1.36-19.redhat_00018.1.el10jws.noarch.rpm SHA-256: 4005fe32045aa66e0a102c440aa30a57d6ef8fb5a1a57419c2d3b1dc43f7268f
jws6-tomcat-jsp-3.1-api-10.1.36-19.redhat_00018.1.el10jws.noarch.rpm SHA-256: 206c59343ff25a8b101766e150ce9d9ce39720d5dc63d308dab7a39ee4f689e6
jws6-tomcat-lib-10.1.36-19.redhat_00018.1.el10jws.noarch.rpm SHA-256: e3f75428a3c6b227265c1284572538f31e65b92a80ea8bb2e1ed23f84aa41885
jws6-tomcat-selinux-10.1.36-19.redhat_00018.1.el10jws.noarch.rpm SHA-256: a1fd50fdc5aa2db737c43c3321c1b8a2a881a3f2a121c903ef4072d69377bce1
jws6-tomcat-servlet-6.0-api-10.1.36-19.redhat_00018.1.el10jws.noarch.rpm SHA-256: c31ccb819cb555c91a31aee2afae4c393bb667da510d4d6807c7a6419f14ebaf
jws6-tomcat-webapps-10.1.36-19.redhat_00018.1.el10jws.noarch.rpm SHA-256: 72a319913e9a90ecf4e987e9724b77efc0d5f3455be683526efd896173ec5963

JBoss Enterprise Web Server 6 for RHEL 9

SRPM
jws6-tomcat-10.1.36-19.redhat_00018.1.el9jws.src.rpm SHA-256: 2bcee7e9f877710795a88b1e07d0bf540d75210f736f23afd605770b7e059083
x86_64
jws6-tomcat-10.1.36-19.redhat_00018.1.el9jws.noarch.rpm SHA-256: 75753afd32b69898b8212418421cb04ada695fc4366ae1e27f80452c3d4156f8
jws6-tomcat-admin-webapps-10.1.36-19.redhat_00018.1.el9jws.noarch.rpm SHA-256: 917c59d15c37d927af03b910abb3ea55300e97efae05f83a40251b0279c84c3a
jws6-tomcat-docs-webapp-10.1.36-19.redhat_00018.1.el9jws.noarch.rpm SHA-256: 37e65a5fc457d2af55a429671918b039be9b85952ed8a5a45e54f3f3864f2e81
jws6-tomcat-el-5.0-api-10.1.36-19.redhat_00018.1.el9jws.noarch.rpm SHA-256: 47f89ed7b2ac919f8bed77117c6f4d725b7608a770cbae657b502c419582644b
jws6-tomcat-javadoc-10.1.36-19.redhat_00018.1.el9jws.noarch.rpm SHA-256: c6a41e2400fb3c696133264fb90635f548dbcc634ed0cbb986b10010231564c5
jws6-tomcat-jsp-3.1-api-10.1.36-19.redhat_00018.1.el9jws.noarch.rpm SHA-256: 890e206695bf23f22d66d17ce892328267854fb4acab3e17242ec7430e0026e3
jws6-tomcat-lib-10.1.36-19.redhat_00018.1.el9jws.noarch.rpm SHA-256: d2dcc73b65233cf1bd0b6bd60586da2b2397206f913e983aa99d0ee62399e0be
jws6-tomcat-selinux-10.1.36-19.redhat_00018.1.el9jws.noarch.rpm SHA-256: 0fe90340f29ba023eeb6c1ad9fee178bb5fcaec5443149c67f64ac9b2c7959d1
jws6-tomcat-servlet-6.0-api-10.1.36-19.redhat_00018.1.el9jws.noarch.rpm SHA-256: 35d6397f96324e5c32180bef5987424b9f1e304c0f1f9a527886e226c19e54c6
jws6-tomcat-webapps-10.1.36-19.redhat_00018.1.el9jws.noarch.rpm SHA-256: c539dce566c7584ffd94522abd7e0edbb135c56e7669e52acd2faa60968fea2d

JBoss Enterprise Web Server 6 for RHEL 8

SRPM
jws6-tomcat-10.1.36-19.redhat_00018.1.el8jws.src.rpm SHA-256: c0115c457ffd3622ca116f9709e547e070404af230ad475a44050ddb701a4a9d
x86_64
jws6-tomcat-10.1.36-19.redhat_00018.1.el8jws.noarch.rpm SHA-256: 23e33e6dbbffe34966a3cb1e442dd91909b12d414924345fad33eac9f23e7b9b
jws6-tomcat-admin-webapps-10.1.36-19.redhat_00018.1.el8jws.noarch.rpm SHA-256: fab8b7445ce17dd542a2735965e4d0ba9061685207164ea3fee3b9dfba64625f
jws6-tomcat-docs-webapp-10.1.36-19.redhat_00018.1.el8jws.noarch.rpm SHA-256: c9472816b11934a8891c942653f601fbc97dbaab31b0dd81a823fc912be50534
jws6-tomcat-el-5.0-api-10.1.36-19.redhat_00018.1.el8jws.noarch.rpm SHA-256: 58a95d576c9725505dcc691227bfaceceeaa9fda445304c5b36029f9468ac78b
jws6-tomcat-javadoc-10.1.36-19.redhat_00018.1.el8jws.noarch.rpm SHA-256: 818e4e5768279acc4c6101a1347d90266b0f5042399900068846ac3c71f014e4
jws6-tomcat-jsp-3.1-api-10.1.36-19.redhat_00018.1.el8jws.noarch.rpm SHA-256: 36b3df1c4f96d324b7e82d19958464ce4ced0dd718ac9642c7618e96cf2797ef
jws6-tomcat-lib-10.1.36-19.redhat_00018.1.el8jws.noarch.rpm SHA-256: 6617c9f027871715a35d1dc2cdbf58f3b2ecb79d14a55b4e24bfe0a0b850956a
jws6-tomcat-selinux-10.1.36-19.redhat_00018.1.el8jws.noarch.rpm SHA-256: 498d03b61dd5df8e152feb7a692d1f1138644e8428a400b10a8ad2cb0f5fd5be
jws6-tomcat-servlet-6.0-api-10.1.36-19.redhat_00018.1.el8jws.noarch.rpm SHA-256: cc111bd12676c07d44e8ffb50bc95b2764b772aceb3bec7d49cf37b3696d2471
jws6-tomcat-webapps-10.1.36-19.redhat_00018.1.el8jws.noarch.rpm SHA-256: bd7d5ca0d0063f98af8d5a8eb01840716fceaa2d60c6a0345e23a8e51d986acd

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.