红帽产品勘误 RHSA-2025:22925 - Security Advisory
发布：
2025-12-09
已更新：
2025-12-09

RHSA-2025:22925 - Security Advisory

概述

Important: Red Hat JBoss Web Server 5.8.6 release and security update

类型/严重性

Security Advisory: Important

Red Hat Lightspeed patch analysis

识别并修复受此公告影响的系统。

查看受影响的系统

标题

An update is now available for Red Hat JBoss Web Server 5.8 on Red Hat Enterprise Linux versions 7, 8, and 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

描述

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.8.6 serves as a replacement for Red Hat JBoss Web Server 5.8.5. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.

Security Fix(es):

  • [Minor Incident] tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames [jws-5] (CVE-2025-48989)
  • tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve [jws-5] (CVE-2025-31651)
  • tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE [jws-5] (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

解决方案

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

受影响的产品

  • JBoss Enterprise Web Server 5 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 8 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 7 x86_64

修复

  • BZ - 2362782 - CVE-2025-31651 tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve
  • BZ - 2373309 - CVE-2025-48989 tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames
  • BZ - 2406591 - CVE-2025-55752 tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE

JBoss Enterprise Web Server 5 for RHEL 9

SRPM
jws5-tomcat-9.0.87-14.redhat_00013.1.el9jws.src.rpm SHA-256: 9ccb862c6b47bb5ccb221dfae7af6a9dcfa45dc0639c6cc16f512bea283ffdf9
x86_64
jws5-tomcat-9.0.87-14.redhat_00013.1.el9jws.noarch.rpm SHA-256: 990794a70a819d97b1b0b7afabdd0e08b54861bd28ff2d1522e427462ba5266a
jws5-tomcat-admin-webapps-9.0.87-14.redhat_00013.1.el9jws.noarch.rpm SHA-256: f49b5b30108591dbda342b51e8a608d20de187259efd3faca0cc9091466d8a93
jws5-tomcat-docs-webapp-9.0.87-14.redhat_00013.1.el9jws.noarch.rpm SHA-256: ce9ca6025725a8082b2b44029fe1e4eb3c5569192edbfe8a4797534384a27d59
jws5-tomcat-el-3.0-api-9.0.87-14.redhat_00013.1.el9jws.noarch.rpm SHA-256: 178db01c459320ead4c8d98c74dc686840ff6b2acd67e811737b1d19fc371c81
jws5-tomcat-javadoc-9.0.87-14.redhat_00013.1.el9jws.noarch.rpm SHA-256: 380f4076e3542c64fe46219a40977c196d78b8e30a1b6937413ed0e223663760
jws5-tomcat-jsp-2.3-api-9.0.87-14.redhat_00013.1.el9jws.noarch.rpm SHA-256: 05fa280db038dd6c0136a2ee98c8ff6c7982bebb5a7f57c501eb8aee8d865ac6
jws5-tomcat-lib-9.0.87-14.redhat_00013.1.el9jws.noarch.rpm SHA-256: 8bf3c1a0bec54cd335c0bced2c525ae4f33ff2265ce10eae32de660df616c4ca
jws5-tomcat-selinux-9.0.87-14.redhat_00013.1.el9jws.noarch.rpm SHA-256: e387751583e4ea19aeddd3f732cc1496e048964379f6bac686d13c103ba130dd
jws5-tomcat-servlet-4.0-api-9.0.87-14.redhat_00013.1.el9jws.noarch.rpm SHA-256: 9d6b855abea5a324e88611564bee9dd1393b8cf19027d194c8324e0b2c3c0668
jws5-tomcat-webapps-9.0.87-14.redhat_00013.1.el9jws.noarch.rpm SHA-256: cfaf484a0c246294e53983456cf973c1b9463b3392611ccfbc75ab9214d2a171

JBoss Enterprise Web Server 5 for RHEL 8

SRPM
jws5-tomcat-9.0.87-14.redhat_00013.1.el8jws.src.rpm SHA-256: 6bbc54442f8969e49ff5c7cfcb604ffc183cf72116d1102e56a19851089b6e8e
x86_64
jws5-tomcat-9.0.87-14.redhat_00013.1.el8jws.noarch.rpm SHA-256: 45a1c705fe0edcd4e9131e38b010ff69d42626171dc1cfc92558ce06bae7e729
jws5-tomcat-admin-webapps-9.0.87-14.redhat_00013.1.el8jws.noarch.rpm SHA-256: 2085bb540b5d34a6a7951dce94550f6b94531d9c3c6412cb7e6f90716dbd4066
jws5-tomcat-docs-webapp-9.0.87-14.redhat_00013.1.el8jws.noarch.rpm SHA-256: 203d3730365b33992da70aebf249c5c07fd3e6ca288910ee318602bda09aa438
jws5-tomcat-el-3.0-api-9.0.87-14.redhat_00013.1.el8jws.noarch.rpm SHA-256: bacd3ed45e58be13d9ad9e955257eb8711f8c2296595c51eda87879b89bc9a36
jws5-tomcat-javadoc-9.0.87-14.redhat_00013.1.el8jws.noarch.rpm SHA-256: 8cd40b861f74b12a2f5646cbc8729724c1816c6154d461d1b7c6cce6553842d5
jws5-tomcat-jsp-2.3-api-9.0.87-14.redhat_00013.1.el8jws.noarch.rpm SHA-256: 6ceebc18c8223c0bb93dc0b571b7f85780418a8d6e25857960869300beaca667
jws5-tomcat-lib-9.0.87-14.redhat_00013.1.el8jws.noarch.rpm SHA-256: 9edfec28d0b0b04fd70f2406ebb6d1fd2e27c076281045857f0c8c78c174cea2
jws5-tomcat-selinux-9.0.87-14.redhat_00013.1.el8jws.noarch.rpm SHA-256: a2a6b1f8e11a3962dde6c1edaa3eb1102723e07e21ca6272481cd058acf9c7d6
jws5-tomcat-servlet-4.0-api-9.0.87-14.redhat_00013.1.el8jws.noarch.rpm SHA-256: 3bad787e5137852a055c43b8faa39840cb2b2edfac36a1b45915ad94d6e15053
jws5-tomcat-webapps-9.0.87-14.redhat_00013.1.el8jws.noarch.rpm SHA-256: f108d6f692d3bf5363efc13fb080abf343dc574ac09899b63bfd5a4aa1ebfb4a

JBoss Enterprise Web Server 5 for RHEL 7

SRPM
jws5-tomcat-9.0.87-14.redhat_00013.1.el7jws.src.rpm SHA-256: 9cac82905e4375a69887c4698a5954e4f716c998ada61d66e29566755b452e0c
x86_64
jws5-tomcat-9.0.87-14.redhat_00013.1.el7jws.noarch.rpm SHA-256: 02ba8fb01bc5397efa5cfb37aa019419bdb075887b42251bccad6c1b126246d2
jws5-tomcat-admin-webapps-9.0.87-14.redhat_00013.1.el7jws.noarch.rpm SHA-256: 6d5f2d178bd2098d9543722dd98c31165db1bcf6d6cf0181e680af0fb3cc0468
jws5-tomcat-docs-webapp-9.0.87-14.redhat_00013.1.el7jws.noarch.rpm SHA-256: c540e248eaaf8c43cb06664561726f69df7daadc8a6992b472b9ddb363955b53
jws5-tomcat-el-3.0-api-9.0.87-14.redhat_00013.1.el7jws.noarch.rpm SHA-256: 0145de018d704898a69dc6e9d019c701730c397a2f156fda7fb19b576b0c2423
jws5-tomcat-java-jdk11-9.0.87-14.redhat_00013.1.el7jws.noarch.rpm SHA-256: dde4590fad2e857dfa27be6698dcddb8136b2dc501a35e6c347dcab775db7985
jws5-tomcat-java-jdk8-9.0.87-14.redhat_00013.1.el7jws.noarch.rpm SHA-256: 960e5072f600eaf7a0fd3a32aca6a6b3cbabf009adb403226b290706428925b0
jws5-tomcat-javadoc-9.0.87-14.redhat_00013.1.el7jws.noarch.rpm SHA-256: e8e5ee39710193c4cdc2ce0f55fe16c69f1f04f88df564cfede5345e9591d2c0
jws5-tomcat-jsp-2.3-api-9.0.87-14.redhat_00013.1.el7jws.noarch.rpm SHA-256: 950e59b28237bce2dca880735fb062a6ae63863f4e1834c939184fd36e5f6644
jws5-tomcat-lib-9.0.87-14.redhat_00013.1.el7jws.noarch.rpm SHA-256: effdcd552b7196ca5e1068cce9d6f710c205e9f3471edcd5a07b7d4b2442b568
jws5-tomcat-selinux-9.0.87-14.redhat_00013.1.el7jws.noarch.rpm SHA-256: 9405b93d7a35c57f550383c37ba21809deac11c0dcff66e280a4f2fae6f68f8c
jws5-tomcat-servlet-4.0-api-9.0.87-14.redhat_00013.1.el7jws.noarch.rpm SHA-256: bdd89380dea4d8317fd8b6d5c91c889e906626ab8b66e5a12b4f2f34960218c1
jws5-tomcat-webapps-9.0.87-14.redhat_00013.1.el7jws.noarch.rpm SHA-256: 6f24b788da38368b5ee481fcb696d985a6b0929d22e7f1605854f153374698ef

Red Hat 安全团队联络方式为 secalert@redhat.com。 更多联络细节请参考 https://access.redhat.com/security/team/contact/。