Red Hat Product Errata RHSA-2025:3608 - Security Advisory
Issued:
2025-04-07
Updated:
2025-05-19

RHSA-2025:3608 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 6.1.0 release and security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Red Hat JBoss Web Server 6.1 is now available for Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 6.1.0 serves as a replacement for Red Hat JBoss Web Server 6.0.5. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.

Security Fix(es):

  • org.apache.tomcat/tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API [jws-6] (CVE-2024-52316)
  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT [jws-6] (CVE-2025-24813)
  • tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame [jws-6] (CVE-2025-31650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 6 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 6 for RHEL 8 x86_64

Fixes

  • BZ - 2326972 - CVE-2024-52316 tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API
  • BZ - 2351129 - CVE-2025-24813 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
  • BZ - 2362783 - CVE-2025-31650 tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

JBoss Enterprise Web Server 6 for RHEL 9

SRPM
jws6-tomcat-10.1.36-6.redhat_00007.1.el9jws.src.rpm SHA-256: e58c0857a5240032983eed0cfc46b073bff6e7859f373651ed1fb709702754bf
jws6-tomcat-jakartaee-migration-1.0.6-2.redhat_00003.1.el9jws.src.rpm SHA-256: 4ffcc264b952d65252abdefa1f9e02fb73a6b2b76de54cd4b0c97906731657c3
jws6-tomcat-native-1.3.1-1.redhat_1.el9jws.src.rpm SHA-256: 905fd2e17b48d0aa53b38884d6f17170a90f3e9cdb4cae0cb22ee897cf541e9c
x86_64
jws6-tomcat-10.1.36-6.redhat_00007.1.el9jws.noarch.rpm SHA-256: 1419874d9c4004a07220d2db180459ab42be04b9f29912950c097d2cced349ad
jws6-tomcat-admin-webapps-10.1.36-6.redhat_00007.1.el9jws.noarch.rpm SHA-256: e3ca5f95d8658f65e06141a7b81ca6056d49743946e1c2dca5cb71982865da46
jws6-tomcat-docs-webapp-10.1.36-6.redhat_00007.1.el9jws.noarch.rpm SHA-256: 912d51220c76c4204d16fa89799d176514fe2147d43db64b5627b07760bedd08
jws6-tomcat-el-5.0-api-10.1.36-6.redhat_00007.1.el9jws.noarch.rpm SHA-256: 944db2c8f1a93f264dd19b069e732334b8f8f56620540d31fda04316c097fc15
jws6-tomcat-jakartaee-migration-1.0.6-2.redhat_00003.1.el9jws.noarch.rpm SHA-256: b922e2b687d22390f2ea415a2debc89dca8bcc1f35608f06d6ad3e41bb11d6ae
jws6-tomcat-javadoc-10.1.36-6.redhat_00007.1.el9jws.noarch.rpm SHA-256: 09f6d180ad7c560d1f0c1e4411e5c893ee628b76e47eaf67c84e0f176aa6fc96
jws6-tomcat-jsp-3.1-api-10.1.36-6.redhat_00007.1.el9jws.noarch.rpm SHA-256: 2c6b0f0bc756b8dc03dc0d43043952e7c3f7268391166a8c9c56356816743d1b
jws6-tomcat-lib-10.1.36-6.redhat_00007.1.el9jws.noarch.rpm SHA-256: 09c6ed772f3d4c8b277e9ff7e75aeac892779bbdf68dddd601cfe5086739420f
jws6-tomcat-native-1.3.1-1.redhat_1.el9jws.x86_64.rpm SHA-256: 77795bb3ef8a06436c5bf7ce67660ceec731512e7119311b6c4277e2ced9ad50
jws6-tomcat-native-debuginfo-1.3.1-1.redhat_1.el9jws.x86_64.rpm SHA-256: e2e6dbccc66c58a79b4f0847bb7cfb9a7647d90fec92398bfef54ec45fa4ecee
jws6-tomcat-selinux-10.1.36-6.redhat_00007.1.el9jws.noarch.rpm SHA-256: 6481c24e0200cceb47aed44654e3b33defc5060b2a51a12a031ea2b9f45b4d39
jws6-tomcat-servlet-6.0-api-10.1.36-6.redhat_00007.1.el9jws.noarch.rpm SHA-256: b0edb71ae3668884eeea40a2560444c620725007b9267e74c0827e675e19960f
jws6-tomcat-webapps-10.1.36-6.redhat_00007.1.el9jws.noarch.rpm SHA-256: 7b98dec7172a20c6c81ec310be3b3589f063ae5fdc9ac66dcb28847086bf35f9

JBoss Enterprise Web Server 6 for RHEL 8

SRPM
jws6-tomcat-10.1.36-6.redhat_00007.1.el8jws.src.rpm SHA-256: b98114aa104238644b4db51bad9df3c22ac3d8d3922118c50c4c0a92fcd82696
jws6-tomcat-jakartaee-migration-1.0.6-2.redhat_00003.1.el8jws.src.rpm SHA-256: bafaeefc5c928c87d7e497a3c378661974a7eec2b10b4f33f76b9efe50f54e7c
jws6-tomcat-native-1.3.1-1.redhat_1.el8jws.src.rpm SHA-256: dcb309ab5f7e49ddd02c4bb07c0660ec8f9eecf94a165a73080f9726d4126194
x86_64
jws6-tomcat-10.1.36-6.redhat_00007.1.el8jws.noarch.rpm SHA-256: fa1c05c5e5472d69e4909bae8c1cf9b86c62defe64a75c56f159e92b54a7aa78
jws6-tomcat-admin-webapps-10.1.36-6.redhat_00007.1.el8jws.noarch.rpm SHA-256: b4fec6569e7c74f3bb9fcd6029e5578fd0547c4649cea88dfbb86beb789549ff
jws6-tomcat-docs-webapp-10.1.36-6.redhat_00007.1.el8jws.noarch.rpm SHA-256: be8ba9c19e4c18a8ea6ba827c4e24021ffb4a692a2ace4378a70c682dffe3a74
jws6-tomcat-el-5.0-api-10.1.36-6.redhat_00007.1.el8jws.noarch.rpm SHA-256: 5c9f6fa7901075411bff79bbbfbc3ef2beb856b8e2aff67b84e147d36e32060e
jws6-tomcat-jakartaee-migration-1.0.6-2.redhat_00003.1.el8jws.noarch.rpm SHA-256: 7ba6dc09c359366d07841aea149ecfdfa55d5ec79685d7346e7b422b45ae7bb2
jws6-tomcat-javadoc-10.1.36-6.redhat_00007.1.el8jws.noarch.rpm SHA-256: 536fbeec419eae5da3ba2f7186e4348cf9f8e7db9ba2762714be29ec743cc695
jws6-tomcat-jsp-3.1-api-10.1.36-6.redhat_00007.1.el8jws.noarch.rpm SHA-256: ad19e295db4b5bb1d4061bd055aed6d9dc1da4d4a7b189c8f9d7939ac30be50c
jws6-tomcat-lib-10.1.36-6.redhat_00007.1.el8jws.noarch.rpm SHA-256: a58bd9bb6c7c5f17d1d6a0174c1f469d0dc3398600107d0c9037614f70d6725e
jws6-tomcat-native-1.3.1-1.redhat_1.el8jws.x86_64.rpm SHA-256: bcdcc1b679ff806d946f4f2009ae2c65a9a08f75e743c6e6757f3cf96552853c
jws6-tomcat-native-debuginfo-1.3.1-1.redhat_1.el8jws.x86_64.rpm SHA-256: 449af41bc7abc14990d32511177db26dcd5f7964bc7baf64ed682a88a6d455ca
jws6-tomcat-selinux-10.1.36-6.redhat_00007.1.el8jws.noarch.rpm SHA-256: 38b1326d0bf73ce0784b75bf89fa39dfd930bc8915f726dacbc0b38ee2aa2850
jws6-tomcat-servlet-6.0-api-10.1.36-6.redhat_00007.1.el8jws.noarch.rpm SHA-256: d5d381a08f46c974eac308cc2ebcc14c19dd054950f4f924d1e85836e12ff998
jws6-tomcat-webapps-10.1.36-6.redhat_00007.1.el8jws.noarch.rpm SHA-256: 1312f185a94545914981407a087acbc3a967242e6b0f10326a1a115127b5accb

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.