Red Hat Product Errata RHSA-2025:23047 - Security Advisory
Issued:
2025-12-10
Updated:
2025-12-10

RHSA-2025:23047 - Security Advisory

Synopsis

Important: tomcat security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for tomcat is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)
  • tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
  • Red Hat Enterprise Linux Server - AUS 9.4 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x

Fixes

  • BZ - 2362782 - CVE-2025-31651 tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve
  • BZ - 2406591 - CVE-2025-55752 tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4

SRPM
tomcat-9.0.87-1.el9_4.7.src.rpm SHA-256: 76c151ad1bd7aeb5191f34d6fcdd9e5afb61617cd51605eec9579f9ac0d2c8a8
x86_64
tomcat-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 47d5f592deec1fd25cc80cf52c51f37d5d23033467e73145b4dd7495327ede00
tomcat-admin-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 1b5f8e377d03ede4fee871b5c5ba57583162be0d944a688f5f05bc4f720dedce
tomcat-docs-webapp-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 008c3f146efbb37154ec68f22063e8ff95a49795bb7dff6647d1908c0ff6a573
tomcat-el-3.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 849335b43961d846a483bba41298687524b6eeb4a374f5e574f4638264e056c1
tomcat-jsp-2.3-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 54a71832f79835965b537ab4cdd37b6bd67cbd5c3c2cfe22b8871795b3034842
tomcat-lib-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 9ebc5ac3ce8b67c02e5d1c8717f603c64ced386e9db467aa2c04205f3fbde490
tomcat-servlet-4.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 5772851cc3313a0ba46aa98859d7483486518ace77b021eee3cc6af0516d9c1f
tomcat-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 76cac839642ead0a208b96a98cd9137aef0dc07425b3ef105a426b9b248ebb60

Red Hat Enterprise Linux Server - AUS 9.4

SRPM
tomcat-9.0.87-1.el9_4.7.src.rpm SHA-256: 76c151ad1bd7aeb5191f34d6fcdd9e5afb61617cd51605eec9579f9ac0d2c8a8
x86_64
tomcat-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 47d5f592deec1fd25cc80cf52c51f37d5d23033467e73145b4dd7495327ede00
tomcat-admin-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 1b5f8e377d03ede4fee871b5c5ba57583162be0d944a688f5f05bc4f720dedce
tomcat-docs-webapp-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 008c3f146efbb37154ec68f22063e8ff95a49795bb7dff6647d1908c0ff6a573
tomcat-el-3.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 849335b43961d846a483bba41298687524b6eeb4a374f5e574f4638264e056c1
tomcat-jsp-2.3-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 54a71832f79835965b537ab4cdd37b6bd67cbd5c3c2cfe22b8871795b3034842
tomcat-lib-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 9ebc5ac3ce8b67c02e5d1c8717f603c64ced386e9db467aa2c04205f3fbde490
tomcat-servlet-4.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 5772851cc3313a0ba46aa98859d7483486518ace77b021eee3cc6af0516d9c1f
tomcat-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 76cac839642ead0a208b96a98cd9137aef0dc07425b3ef105a426b9b248ebb60

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4

SRPM
tomcat-9.0.87-1.el9_4.7.src.rpm SHA-256: 76c151ad1bd7aeb5191f34d6fcdd9e5afb61617cd51605eec9579f9ac0d2c8a8
s390x
tomcat-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 47d5f592deec1fd25cc80cf52c51f37d5d23033467e73145b4dd7495327ede00
tomcat-admin-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 1b5f8e377d03ede4fee871b5c5ba57583162be0d944a688f5f05bc4f720dedce
tomcat-docs-webapp-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 008c3f146efbb37154ec68f22063e8ff95a49795bb7dff6647d1908c0ff6a573
tomcat-el-3.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 849335b43961d846a483bba41298687524b6eeb4a374f5e574f4638264e056c1
tomcat-jsp-2.3-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 54a71832f79835965b537ab4cdd37b6bd67cbd5c3c2cfe22b8871795b3034842
tomcat-lib-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 9ebc5ac3ce8b67c02e5d1c8717f603c64ced386e9db467aa2c04205f3fbde490
tomcat-servlet-4.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 5772851cc3313a0ba46aa98859d7483486518ace77b021eee3cc6af0516d9c1f
tomcat-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 76cac839642ead0a208b96a98cd9137aef0dc07425b3ef105a426b9b248ebb60

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4

SRPM
tomcat-9.0.87-1.el9_4.7.src.rpm SHA-256: 76c151ad1bd7aeb5191f34d6fcdd9e5afb61617cd51605eec9579f9ac0d2c8a8
ppc64le
tomcat-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 47d5f592deec1fd25cc80cf52c51f37d5d23033467e73145b4dd7495327ede00
tomcat-admin-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 1b5f8e377d03ede4fee871b5c5ba57583162be0d944a688f5f05bc4f720dedce
tomcat-docs-webapp-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 008c3f146efbb37154ec68f22063e8ff95a49795bb7dff6647d1908c0ff6a573
tomcat-el-3.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 849335b43961d846a483bba41298687524b6eeb4a374f5e574f4638264e056c1
tomcat-jsp-2.3-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 54a71832f79835965b537ab4cdd37b6bd67cbd5c3c2cfe22b8871795b3034842
tomcat-lib-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 9ebc5ac3ce8b67c02e5d1c8717f603c64ced386e9db467aa2c04205f3fbde490
tomcat-servlet-4.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 5772851cc3313a0ba46aa98859d7483486518ace77b021eee3cc6af0516d9c1f
tomcat-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 76cac839642ead0a208b96a98cd9137aef0dc07425b3ef105a426b9b248ebb60

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4

SRPM
tomcat-9.0.87-1.el9_4.7.src.rpm SHA-256: 76c151ad1bd7aeb5191f34d6fcdd9e5afb61617cd51605eec9579f9ac0d2c8a8
aarch64
tomcat-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 47d5f592deec1fd25cc80cf52c51f37d5d23033467e73145b4dd7495327ede00
tomcat-admin-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 1b5f8e377d03ede4fee871b5c5ba57583162be0d944a688f5f05bc4f720dedce
tomcat-docs-webapp-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 008c3f146efbb37154ec68f22063e8ff95a49795bb7dff6647d1908c0ff6a573
tomcat-el-3.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 849335b43961d846a483bba41298687524b6eeb4a374f5e574f4638264e056c1
tomcat-jsp-2.3-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 54a71832f79835965b537ab4cdd37b6bd67cbd5c3c2cfe22b8871795b3034842
tomcat-lib-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 9ebc5ac3ce8b67c02e5d1c8717f603c64ced386e9db467aa2c04205f3fbde490
tomcat-servlet-4.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 5772851cc3313a0ba46aa98859d7483486518ace77b021eee3cc6af0516d9c1f
tomcat-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 76cac839642ead0a208b96a98cd9137aef0dc07425b3ef105a426b9b248ebb60

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4

SRPM
tomcat-9.0.87-1.el9_4.7.src.rpm SHA-256: 76c151ad1bd7aeb5191f34d6fcdd9e5afb61617cd51605eec9579f9ac0d2c8a8
ppc64le
tomcat-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 47d5f592deec1fd25cc80cf52c51f37d5d23033467e73145b4dd7495327ede00
tomcat-admin-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 1b5f8e377d03ede4fee871b5c5ba57583162be0d944a688f5f05bc4f720dedce
tomcat-docs-webapp-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 008c3f146efbb37154ec68f22063e8ff95a49795bb7dff6647d1908c0ff6a573
tomcat-el-3.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 849335b43961d846a483bba41298687524b6eeb4a374f5e574f4638264e056c1
tomcat-jsp-2.3-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 54a71832f79835965b537ab4cdd37b6bd67cbd5c3c2cfe22b8871795b3034842
tomcat-lib-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 9ebc5ac3ce8b67c02e5d1c8717f603c64ced386e9db467aa2c04205f3fbde490
tomcat-servlet-4.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 5772851cc3313a0ba46aa98859d7483486518ace77b021eee3cc6af0516d9c1f
tomcat-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 76cac839642ead0a208b96a98cd9137aef0dc07425b3ef105a426b9b248ebb60

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4

SRPM
tomcat-9.0.87-1.el9_4.7.src.rpm SHA-256: 76c151ad1bd7aeb5191f34d6fcdd9e5afb61617cd51605eec9579f9ac0d2c8a8
x86_64
tomcat-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 47d5f592deec1fd25cc80cf52c51f37d5d23033467e73145b4dd7495327ede00
tomcat-admin-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 1b5f8e377d03ede4fee871b5c5ba57583162be0d944a688f5f05bc4f720dedce
tomcat-docs-webapp-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 008c3f146efbb37154ec68f22063e8ff95a49795bb7dff6647d1908c0ff6a573
tomcat-el-3.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 849335b43961d846a483bba41298687524b6eeb4a374f5e574f4638264e056c1
tomcat-jsp-2.3-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 54a71832f79835965b537ab4cdd37b6bd67cbd5c3c2cfe22b8871795b3034842
tomcat-lib-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 9ebc5ac3ce8b67c02e5d1c8717f603c64ced386e9db467aa2c04205f3fbde490
tomcat-servlet-4.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 5772851cc3313a0ba46aa98859d7483486518ace77b021eee3cc6af0516d9c1f
tomcat-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 76cac839642ead0a208b96a98cd9137aef0dc07425b3ef105a426b9b248ebb60

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4

SRPM
tomcat-9.0.87-1.el9_4.7.src.rpm SHA-256: 76c151ad1bd7aeb5191f34d6fcdd9e5afb61617cd51605eec9579f9ac0d2c8a8
aarch64
tomcat-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 47d5f592deec1fd25cc80cf52c51f37d5d23033467e73145b4dd7495327ede00
tomcat-admin-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 1b5f8e377d03ede4fee871b5c5ba57583162be0d944a688f5f05bc4f720dedce
tomcat-docs-webapp-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 008c3f146efbb37154ec68f22063e8ff95a49795bb7dff6647d1908c0ff6a573
tomcat-el-3.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 849335b43961d846a483bba41298687524b6eeb4a374f5e574f4638264e056c1
tomcat-jsp-2.3-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 54a71832f79835965b537ab4cdd37b6bd67cbd5c3c2cfe22b8871795b3034842
tomcat-lib-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 9ebc5ac3ce8b67c02e5d1c8717f603c64ced386e9db467aa2c04205f3fbde490
tomcat-servlet-4.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 5772851cc3313a0ba46aa98859d7483486518ace77b021eee3cc6af0516d9c1f
tomcat-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 76cac839642ead0a208b96a98cd9137aef0dc07425b3ef105a426b9b248ebb60

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4

SRPM
tomcat-9.0.87-1.el9_4.7.src.rpm SHA-256: 76c151ad1bd7aeb5191f34d6fcdd9e5afb61617cd51605eec9579f9ac0d2c8a8
s390x
tomcat-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 47d5f592deec1fd25cc80cf52c51f37d5d23033467e73145b4dd7495327ede00
tomcat-admin-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 1b5f8e377d03ede4fee871b5c5ba57583162be0d944a688f5f05bc4f720dedce
tomcat-docs-webapp-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 008c3f146efbb37154ec68f22063e8ff95a49795bb7dff6647d1908c0ff6a573
tomcat-el-3.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 849335b43961d846a483bba41298687524b6eeb4a374f5e574f4638264e056c1
tomcat-jsp-2.3-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 54a71832f79835965b537ab4cdd37b6bd67cbd5c3c2cfe22b8871795b3034842
tomcat-lib-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 9ebc5ac3ce8b67c02e5d1c8717f603c64ced386e9db467aa2c04205f3fbde490
tomcat-servlet-4.0-api-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 5772851cc3313a0ba46aa98859d7483486518ace77b021eee3cc6af0516d9c1f
tomcat-webapps-9.0.87-1.el9_4.7.noarch.rpm SHA-256: 76cac839642ead0a208b96a98cd9137aef0dc07425b3ef105a426b9b248ebb60

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.