Red Hat Product Errata RHSA-2025:3647 - Security Advisory
Issued:
2025-04-07
Updated:
2025-04-07

RHSA-2025:3647 - Security Advisory

Synopsis

Moderate: tomcat security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for tomcat is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)
  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
  • Red Hat Enterprise Linux Server - AUS 9.4 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x

Fixes

  • BZ - 2332817 - CVE-2024-50379 tomcat: RCE due to TOCTOU issue in JSP compilation
  • BZ - 2351129 - CVE-2025-24813 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4

SRPM
tomcat-9.0.87-1.el9_4.3.src.rpm SHA-256: 015b61edb21ce1fef800e546bc9e729e14f092860ae5db79c5e4e0aca084e572
x86_64
tomcat-9.0.87-1.el9_4.3.noarch.rpm SHA-256: ddab75271408a7a624f785a056fa8b9a51c3954c19763e7ef7094803b9663b19
tomcat-admin-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: b90239f5036dad5870e91bf35f135f02b33831932f73216bd75b5c5f912edd79
tomcat-docs-webapp-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 3e4ae5fb5914bd955ca3e6dac841088ec3af2faac719460d69c06ff1a5824680
tomcat-el-3.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 32448bc26a695197ab82406e8c4a3225d73196ee5e2bbf9d3f661bdf1408c459
tomcat-jsp-2.3-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: c987b26f67909d15f67d9022dffe2a970d46fd7e5334085ba6ac3098a0b15a5f
tomcat-lib-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 319701adc88d081f04a19028a7676e35dd53117a460e621c2d3cd534d3a2e501
tomcat-servlet-4.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 5d8727c6fcc0383b43e5231c6ed27862c19a6135e3a9b1ad42e6f37c1c3a7710
tomcat-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 528c805392a8bfcb19c29d57f00d0a0bcc578108655984393dfbfe9b0e61bab3

Red Hat Enterprise Linux Server - AUS 9.4

SRPM
tomcat-9.0.87-1.el9_4.3.src.rpm SHA-256: 015b61edb21ce1fef800e546bc9e729e14f092860ae5db79c5e4e0aca084e572
x86_64
tomcat-9.0.87-1.el9_4.3.noarch.rpm SHA-256: ddab75271408a7a624f785a056fa8b9a51c3954c19763e7ef7094803b9663b19
tomcat-admin-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: b90239f5036dad5870e91bf35f135f02b33831932f73216bd75b5c5f912edd79
tomcat-docs-webapp-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 3e4ae5fb5914bd955ca3e6dac841088ec3af2faac719460d69c06ff1a5824680
tomcat-el-3.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 32448bc26a695197ab82406e8c4a3225d73196ee5e2bbf9d3f661bdf1408c459
tomcat-jsp-2.3-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: c987b26f67909d15f67d9022dffe2a970d46fd7e5334085ba6ac3098a0b15a5f
tomcat-lib-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 319701adc88d081f04a19028a7676e35dd53117a460e621c2d3cd534d3a2e501
tomcat-servlet-4.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 5d8727c6fcc0383b43e5231c6ed27862c19a6135e3a9b1ad42e6f37c1c3a7710
tomcat-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 528c805392a8bfcb19c29d57f00d0a0bcc578108655984393dfbfe9b0e61bab3

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4

SRPM
tomcat-9.0.87-1.el9_4.3.src.rpm SHA-256: 015b61edb21ce1fef800e546bc9e729e14f092860ae5db79c5e4e0aca084e572
s390x
tomcat-9.0.87-1.el9_4.3.noarch.rpm SHA-256: ddab75271408a7a624f785a056fa8b9a51c3954c19763e7ef7094803b9663b19
tomcat-admin-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: b90239f5036dad5870e91bf35f135f02b33831932f73216bd75b5c5f912edd79
tomcat-docs-webapp-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 3e4ae5fb5914bd955ca3e6dac841088ec3af2faac719460d69c06ff1a5824680
tomcat-el-3.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 32448bc26a695197ab82406e8c4a3225d73196ee5e2bbf9d3f661bdf1408c459
tomcat-jsp-2.3-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: c987b26f67909d15f67d9022dffe2a970d46fd7e5334085ba6ac3098a0b15a5f
tomcat-lib-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 319701adc88d081f04a19028a7676e35dd53117a460e621c2d3cd534d3a2e501
tomcat-servlet-4.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 5d8727c6fcc0383b43e5231c6ed27862c19a6135e3a9b1ad42e6f37c1c3a7710
tomcat-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 528c805392a8bfcb19c29d57f00d0a0bcc578108655984393dfbfe9b0e61bab3

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4

SRPM
tomcat-9.0.87-1.el9_4.3.src.rpm SHA-256: 015b61edb21ce1fef800e546bc9e729e14f092860ae5db79c5e4e0aca084e572
ppc64le
tomcat-9.0.87-1.el9_4.3.noarch.rpm SHA-256: ddab75271408a7a624f785a056fa8b9a51c3954c19763e7ef7094803b9663b19
tomcat-admin-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: b90239f5036dad5870e91bf35f135f02b33831932f73216bd75b5c5f912edd79
tomcat-docs-webapp-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 3e4ae5fb5914bd955ca3e6dac841088ec3af2faac719460d69c06ff1a5824680
tomcat-el-3.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 32448bc26a695197ab82406e8c4a3225d73196ee5e2bbf9d3f661bdf1408c459
tomcat-jsp-2.3-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: c987b26f67909d15f67d9022dffe2a970d46fd7e5334085ba6ac3098a0b15a5f
tomcat-lib-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 319701adc88d081f04a19028a7676e35dd53117a460e621c2d3cd534d3a2e501
tomcat-servlet-4.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 5d8727c6fcc0383b43e5231c6ed27862c19a6135e3a9b1ad42e6f37c1c3a7710
tomcat-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 528c805392a8bfcb19c29d57f00d0a0bcc578108655984393dfbfe9b0e61bab3

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4

SRPM
tomcat-9.0.87-1.el9_4.3.src.rpm SHA-256: 015b61edb21ce1fef800e546bc9e729e14f092860ae5db79c5e4e0aca084e572
aarch64
tomcat-9.0.87-1.el9_4.3.noarch.rpm SHA-256: ddab75271408a7a624f785a056fa8b9a51c3954c19763e7ef7094803b9663b19
tomcat-admin-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: b90239f5036dad5870e91bf35f135f02b33831932f73216bd75b5c5f912edd79
tomcat-docs-webapp-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 3e4ae5fb5914bd955ca3e6dac841088ec3af2faac719460d69c06ff1a5824680
tomcat-el-3.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 32448bc26a695197ab82406e8c4a3225d73196ee5e2bbf9d3f661bdf1408c459
tomcat-jsp-2.3-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: c987b26f67909d15f67d9022dffe2a970d46fd7e5334085ba6ac3098a0b15a5f
tomcat-lib-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 319701adc88d081f04a19028a7676e35dd53117a460e621c2d3cd534d3a2e501
tomcat-servlet-4.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 5d8727c6fcc0383b43e5231c6ed27862c19a6135e3a9b1ad42e6f37c1c3a7710
tomcat-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 528c805392a8bfcb19c29d57f00d0a0bcc578108655984393dfbfe9b0e61bab3

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4

SRPM
tomcat-9.0.87-1.el9_4.3.src.rpm SHA-256: 015b61edb21ce1fef800e546bc9e729e14f092860ae5db79c5e4e0aca084e572
ppc64le
tomcat-9.0.87-1.el9_4.3.noarch.rpm SHA-256: ddab75271408a7a624f785a056fa8b9a51c3954c19763e7ef7094803b9663b19
tomcat-admin-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: b90239f5036dad5870e91bf35f135f02b33831932f73216bd75b5c5f912edd79
tomcat-docs-webapp-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 3e4ae5fb5914bd955ca3e6dac841088ec3af2faac719460d69c06ff1a5824680
tomcat-el-3.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 32448bc26a695197ab82406e8c4a3225d73196ee5e2bbf9d3f661bdf1408c459
tomcat-jsp-2.3-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: c987b26f67909d15f67d9022dffe2a970d46fd7e5334085ba6ac3098a0b15a5f
tomcat-lib-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 319701adc88d081f04a19028a7676e35dd53117a460e621c2d3cd534d3a2e501
tomcat-servlet-4.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 5d8727c6fcc0383b43e5231c6ed27862c19a6135e3a9b1ad42e6f37c1c3a7710
tomcat-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 528c805392a8bfcb19c29d57f00d0a0bcc578108655984393dfbfe9b0e61bab3

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4

SRPM
tomcat-9.0.87-1.el9_4.3.src.rpm SHA-256: 015b61edb21ce1fef800e546bc9e729e14f092860ae5db79c5e4e0aca084e572
x86_64
tomcat-9.0.87-1.el9_4.3.noarch.rpm SHA-256: ddab75271408a7a624f785a056fa8b9a51c3954c19763e7ef7094803b9663b19
tomcat-admin-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: b90239f5036dad5870e91bf35f135f02b33831932f73216bd75b5c5f912edd79
tomcat-docs-webapp-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 3e4ae5fb5914bd955ca3e6dac841088ec3af2faac719460d69c06ff1a5824680
tomcat-el-3.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 32448bc26a695197ab82406e8c4a3225d73196ee5e2bbf9d3f661bdf1408c459
tomcat-jsp-2.3-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: c987b26f67909d15f67d9022dffe2a970d46fd7e5334085ba6ac3098a0b15a5f
tomcat-lib-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 319701adc88d081f04a19028a7676e35dd53117a460e621c2d3cd534d3a2e501
tomcat-servlet-4.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 5d8727c6fcc0383b43e5231c6ed27862c19a6135e3a9b1ad42e6f37c1c3a7710
tomcat-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 528c805392a8bfcb19c29d57f00d0a0bcc578108655984393dfbfe9b0e61bab3

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4

SRPM
tomcat-9.0.87-1.el9_4.3.src.rpm SHA-256: 015b61edb21ce1fef800e546bc9e729e14f092860ae5db79c5e4e0aca084e572
aarch64
tomcat-9.0.87-1.el9_4.3.noarch.rpm SHA-256: ddab75271408a7a624f785a056fa8b9a51c3954c19763e7ef7094803b9663b19
tomcat-admin-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: b90239f5036dad5870e91bf35f135f02b33831932f73216bd75b5c5f912edd79
tomcat-docs-webapp-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 3e4ae5fb5914bd955ca3e6dac841088ec3af2faac719460d69c06ff1a5824680
tomcat-el-3.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 32448bc26a695197ab82406e8c4a3225d73196ee5e2bbf9d3f661bdf1408c459
tomcat-jsp-2.3-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: c987b26f67909d15f67d9022dffe2a970d46fd7e5334085ba6ac3098a0b15a5f
tomcat-lib-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 319701adc88d081f04a19028a7676e35dd53117a460e621c2d3cd534d3a2e501
tomcat-servlet-4.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 5d8727c6fcc0383b43e5231c6ed27862c19a6135e3a9b1ad42e6f37c1c3a7710
tomcat-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 528c805392a8bfcb19c29d57f00d0a0bcc578108655984393dfbfe9b0e61bab3

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4

SRPM
tomcat-9.0.87-1.el9_4.3.src.rpm SHA-256: 015b61edb21ce1fef800e546bc9e729e14f092860ae5db79c5e4e0aca084e572
s390x
tomcat-9.0.87-1.el9_4.3.noarch.rpm SHA-256: ddab75271408a7a624f785a056fa8b9a51c3954c19763e7ef7094803b9663b19
tomcat-admin-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: b90239f5036dad5870e91bf35f135f02b33831932f73216bd75b5c5f912edd79
tomcat-docs-webapp-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 3e4ae5fb5914bd955ca3e6dac841088ec3af2faac719460d69c06ff1a5824680
tomcat-el-3.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 32448bc26a695197ab82406e8c4a3225d73196ee5e2bbf9d3f661bdf1408c459
tomcat-jsp-2.3-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: c987b26f67909d15f67d9022dffe2a970d46fd7e5334085ba6ac3098a0b15a5f
tomcat-lib-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 319701adc88d081f04a19028a7676e35dd53117a460e621c2d3cd534d3a2e501
tomcat-servlet-4.0-api-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 5d8727c6fcc0383b43e5231c6ed27862c19a6135e3a9b1ad42e6f37c1c3a7710
tomcat-webapps-9.0.87-1.el9_4.3.noarch.rpm SHA-256: 528c805392a8bfcb19c29d57f00d0a0bcc578108655984393dfbfe9b0e61bab3

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.