Red Hat Product Errata RHSA-2025:3646 - Security Advisory
Issued:
2025-04-07
Updated:
2025-04-07

RHSA-2025:3646 - Security Advisory

Synopsis

Moderate: tomcat security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for tomcat is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)
  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2 x86_64
  • Red Hat Enterprise Linux Server - AUS 9.2 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.2 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.2 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.2 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x

Fixes

  • BZ - 2332817 - CVE-2024-50379 tomcat: RCE due to TOCTOU issue in JSP compilation
  • BZ - 2351129 - CVE-2025-24813 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2

SRPM
tomcat-9.0.87-1.el9_2.3.src.rpm SHA-256: ca252d43c407f54b463c2781e351d192d01d81f04d184b19e6c27ce9a04e948e
x86_64
tomcat-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 9c709371176c94d69a7b2ce19bdd7140ccfc7c31d975f8f7f4992ff5b14463c1
tomcat-admin-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 32799c724519ddff1e2d7913e7455d277fd05aedb7d870a601b65bb9cbf1a5d1
tomcat-docs-webapp-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c866e6a0cb5e97ffe2bb149e105fbde44cbed561011ea4f87a2fa08adabbd2c0
tomcat-el-3.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c290884c287eec6c269fc11578d45d8fa4ba3c9226474685ced699fdaa9905a9
tomcat-jsp-2.3-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: ddcff8c4ab98a03b53b826217fc62e033859af2a8bf35f81969afa5c668f6b8e
tomcat-lib-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 8df61dd3447864909f6616ce83b3891490a685e517ad78970e767847687af98e
tomcat-servlet-4.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 91fec1afb7c7f601270066516a3269d6d26d6327713115801d729e6eafd2abbd
tomcat-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: d63ab77ed968ccb216cc9c8f1987445ed0f2ef16e8b7b0522e66590cecfa769b

Red Hat Enterprise Linux Server - AUS 9.2

SRPM
tomcat-9.0.87-1.el9_2.3.src.rpm SHA-256: ca252d43c407f54b463c2781e351d192d01d81f04d184b19e6c27ce9a04e948e
x86_64
tomcat-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 9c709371176c94d69a7b2ce19bdd7140ccfc7c31d975f8f7f4992ff5b14463c1
tomcat-admin-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 32799c724519ddff1e2d7913e7455d277fd05aedb7d870a601b65bb9cbf1a5d1
tomcat-docs-webapp-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c866e6a0cb5e97ffe2bb149e105fbde44cbed561011ea4f87a2fa08adabbd2c0
tomcat-el-3.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c290884c287eec6c269fc11578d45d8fa4ba3c9226474685ced699fdaa9905a9
tomcat-jsp-2.3-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: ddcff8c4ab98a03b53b826217fc62e033859af2a8bf35f81969afa5c668f6b8e
tomcat-lib-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 8df61dd3447864909f6616ce83b3891490a685e517ad78970e767847687af98e
tomcat-servlet-4.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 91fec1afb7c7f601270066516a3269d6d26d6327713115801d729e6eafd2abbd
tomcat-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: d63ab77ed968ccb216cc9c8f1987445ed0f2ef16e8b7b0522e66590cecfa769b

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.2

SRPM
tomcat-9.0.87-1.el9_2.3.src.rpm SHA-256: ca252d43c407f54b463c2781e351d192d01d81f04d184b19e6c27ce9a04e948e
s390x
tomcat-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 9c709371176c94d69a7b2ce19bdd7140ccfc7c31d975f8f7f4992ff5b14463c1
tomcat-admin-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 32799c724519ddff1e2d7913e7455d277fd05aedb7d870a601b65bb9cbf1a5d1
tomcat-docs-webapp-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c866e6a0cb5e97ffe2bb149e105fbde44cbed561011ea4f87a2fa08adabbd2c0
tomcat-el-3.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c290884c287eec6c269fc11578d45d8fa4ba3c9226474685ced699fdaa9905a9
tomcat-jsp-2.3-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: ddcff8c4ab98a03b53b826217fc62e033859af2a8bf35f81969afa5c668f6b8e
tomcat-lib-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 8df61dd3447864909f6616ce83b3891490a685e517ad78970e767847687af98e
tomcat-servlet-4.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 91fec1afb7c7f601270066516a3269d6d26d6327713115801d729e6eafd2abbd
tomcat-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: d63ab77ed968ccb216cc9c8f1987445ed0f2ef16e8b7b0522e66590cecfa769b

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.2

SRPM
tomcat-9.0.87-1.el9_2.3.src.rpm SHA-256: ca252d43c407f54b463c2781e351d192d01d81f04d184b19e6c27ce9a04e948e
ppc64le
tomcat-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 9c709371176c94d69a7b2ce19bdd7140ccfc7c31d975f8f7f4992ff5b14463c1
tomcat-admin-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 32799c724519ddff1e2d7913e7455d277fd05aedb7d870a601b65bb9cbf1a5d1
tomcat-docs-webapp-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c866e6a0cb5e97ffe2bb149e105fbde44cbed561011ea4f87a2fa08adabbd2c0
tomcat-el-3.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c290884c287eec6c269fc11578d45d8fa4ba3c9226474685ced699fdaa9905a9
tomcat-jsp-2.3-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: ddcff8c4ab98a03b53b826217fc62e033859af2a8bf35f81969afa5c668f6b8e
tomcat-lib-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 8df61dd3447864909f6616ce83b3891490a685e517ad78970e767847687af98e
tomcat-servlet-4.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 91fec1afb7c7f601270066516a3269d6d26d6327713115801d729e6eafd2abbd
tomcat-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: d63ab77ed968ccb216cc9c8f1987445ed0f2ef16e8b7b0522e66590cecfa769b

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.2

SRPM
tomcat-9.0.87-1.el9_2.3.src.rpm SHA-256: ca252d43c407f54b463c2781e351d192d01d81f04d184b19e6c27ce9a04e948e
aarch64
tomcat-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 9c709371176c94d69a7b2ce19bdd7140ccfc7c31d975f8f7f4992ff5b14463c1
tomcat-admin-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 32799c724519ddff1e2d7913e7455d277fd05aedb7d870a601b65bb9cbf1a5d1
tomcat-docs-webapp-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c866e6a0cb5e97ffe2bb149e105fbde44cbed561011ea4f87a2fa08adabbd2c0
tomcat-el-3.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c290884c287eec6c269fc11578d45d8fa4ba3c9226474685ced699fdaa9905a9
tomcat-jsp-2.3-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: ddcff8c4ab98a03b53b826217fc62e033859af2a8bf35f81969afa5c668f6b8e
tomcat-lib-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 8df61dd3447864909f6616ce83b3891490a685e517ad78970e767847687af98e
tomcat-servlet-4.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 91fec1afb7c7f601270066516a3269d6d26d6327713115801d729e6eafd2abbd
tomcat-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: d63ab77ed968ccb216cc9c8f1987445ed0f2ef16e8b7b0522e66590cecfa769b

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2

SRPM
tomcat-9.0.87-1.el9_2.3.src.rpm SHA-256: ca252d43c407f54b463c2781e351d192d01d81f04d184b19e6c27ce9a04e948e
ppc64le
tomcat-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 9c709371176c94d69a7b2ce19bdd7140ccfc7c31d975f8f7f4992ff5b14463c1
tomcat-admin-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 32799c724519ddff1e2d7913e7455d277fd05aedb7d870a601b65bb9cbf1a5d1
tomcat-docs-webapp-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c866e6a0cb5e97ffe2bb149e105fbde44cbed561011ea4f87a2fa08adabbd2c0
tomcat-el-3.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c290884c287eec6c269fc11578d45d8fa4ba3c9226474685ced699fdaa9905a9
tomcat-jsp-2.3-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: ddcff8c4ab98a03b53b826217fc62e033859af2a8bf35f81969afa5c668f6b8e
tomcat-lib-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 8df61dd3447864909f6616ce83b3891490a685e517ad78970e767847687af98e
tomcat-servlet-4.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 91fec1afb7c7f601270066516a3269d6d26d6327713115801d729e6eafd2abbd
tomcat-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: d63ab77ed968ccb216cc9c8f1987445ed0f2ef16e8b7b0522e66590cecfa769b

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2

SRPM
tomcat-9.0.87-1.el9_2.3.src.rpm SHA-256: ca252d43c407f54b463c2781e351d192d01d81f04d184b19e6c27ce9a04e948e
x86_64
tomcat-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 9c709371176c94d69a7b2ce19bdd7140ccfc7c31d975f8f7f4992ff5b14463c1
tomcat-admin-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 32799c724519ddff1e2d7913e7455d277fd05aedb7d870a601b65bb9cbf1a5d1
tomcat-docs-webapp-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c866e6a0cb5e97ffe2bb149e105fbde44cbed561011ea4f87a2fa08adabbd2c0
tomcat-el-3.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c290884c287eec6c269fc11578d45d8fa4ba3c9226474685ced699fdaa9905a9
tomcat-jsp-2.3-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: ddcff8c4ab98a03b53b826217fc62e033859af2a8bf35f81969afa5c668f6b8e
tomcat-lib-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 8df61dd3447864909f6616ce83b3891490a685e517ad78970e767847687af98e
tomcat-servlet-4.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 91fec1afb7c7f601270066516a3269d6d26d6327713115801d729e6eafd2abbd
tomcat-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: d63ab77ed968ccb216cc9c8f1987445ed0f2ef16e8b7b0522e66590cecfa769b

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2

SRPM
tomcat-9.0.87-1.el9_2.3.src.rpm SHA-256: ca252d43c407f54b463c2781e351d192d01d81f04d184b19e6c27ce9a04e948e
aarch64
tomcat-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 9c709371176c94d69a7b2ce19bdd7140ccfc7c31d975f8f7f4992ff5b14463c1
tomcat-admin-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 32799c724519ddff1e2d7913e7455d277fd05aedb7d870a601b65bb9cbf1a5d1
tomcat-docs-webapp-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c866e6a0cb5e97ffe2bb149e105fbde44cbed561011ea4f87a2fa08adabbd2c0
tomcat-el-3.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c290884c287eec6c269fc11578d45d8fa4ba3c9226474685ced699fdaa9905a9
tomcat-jsp-2.3-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: ddcff8c4ab98a03b53b826217fc62e033859af2a8bf35f81969afa5c668f6b8e
tomcat-lib-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 8df61dd3447864909f6616ce83b3891490a685e517ad78970e767847687af98e
tomcat-servlet-4.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 91fec1afb7c7f601270066516a3269d6d26d6327713115801d729e6eafd2abbd
tomcat-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: d63ab77ed968ccb216cc9c8f1987445ed0f2ef16e8b7b0522e66590cecfa769b

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2

SRPM
tomcat-9.0.87-1.el9_2.3.src.rpm SHA-256: ca252d43c407f54b463c2781e351d192d01d81f04d184b19e6c27ce9a04e948e
s390x
tomcat-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 9c709371176c94d69a7b2ce19bdd7140ccfc7c31d975f8f7f4992ff5b14463c1
tomcat-admin-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 32799c724519ddff1e2d7913e7455d277fd05aedb7d870a601b65bb9cbf1a5d1
tomcat-docs-webapp-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c866e6a0cb5e97ffe2bb149e105fbde44cbed561011ea4f87a2fa08adabbd2c0
tomcat-el-3.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: c290884c287eec6c269fc11578d45d8fa4ba3c9226474685ced699fdaa9905a9
tomcat-jsp-2.3-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: ddcff8c4ab98a03b53b826217fc62e033859af2a8bf35f81969afa5c668f6b8e
tomcat-lib-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 8df61dd3447864909f6616ce83b3891490a685e517ad78970e767847687af98e
tomcat-servlet-4.0-api-9.0.87-1.el9_2.3.noarch.rpm SHA-256: 91fec1afb7c7f601270066516a3269d6d26d6327713115801d729e6eafd2abbd
tomcat-webapps-9.0.87-1.el9_2.3.noarch.rpm SHA-256: d63ab77ed968ccb216cc9c8f1987445ed0f2ef16e8b7b0522e66590cecfa769b

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.