Red Hat Product Errata RHSA-2025:3684 - Security Advisory
Issued:
2025-04-08
Updated:
2025-04-08

RHSA-2025:3684 - Security Advisory

Synopsis

Moderate: tomcat security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for tomcat is now available for Red Hat Enterprise Linux 8.8 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)
  • tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64

Fixes

  • BZ - 2332817 - CVE-2024-50379 tomcat: RCE due to TOCTOU issue in JSP compilation
  • BZ - 2351129 - CVE-2025-24813 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8

SRPM
tomcat-9.0.87-1.el8_8.4.src.rpm SHA-256: da848b2d5eef546f6269f33ea3ab2a64f22cb30f1e87da2214ebc1bc9be39aee
x86_64
tomcat-9.0.87-1.el8_8.4.noarch.rpm SHA-256: aea36253ad9cc0fbe73066c271ee01035141e3ee6acff3f3be6e6c7b579b5759
tomcat-admin-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 65000ecee4fe1ba4b42986f8d739dd25843e921223eab4792a0933ad7fa9cb3c
tomcat-docs-webapp-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 8293906803c51af7d25193e7782bf3a1c20560e7eb60badf76d2d55dd8243e17
tomcat-el-3.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: c81598141b6eb0eb4763132492208eab8491cecc99f13500fbf3cea8eac093f2
tomcat-jsp-2.3-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 321a6d5087d33a258dbc3c1077c04edf1a2dee81cd9f2856d1b828d02edd69cb
tomcat-lib-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 6d1585b0756ed45d4e272b9af781606a9fe85f6e53fb4de4914b645368885436
tomcat-servlet-4.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 391210040103eb03e2e84bbc28358f9b97ba18a247cde12003dec1cb9a5b5ad0
tomcat-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 43a5b570ec11d0363b8d06092777db8f308d3db1c9f73f63aa454102d3fc3fb6

Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8

SRPM
tomcat-9.0.87-1.el8_8.4.src.rpm SHA-256: da848b2d5eef546f6269f33ea3ab2a64f22cb30f1e87da2214ebc1bc9be39aee
x86_64
tomcat-9.0.87-1.el8_8.4.noarch.rpm SHA-256: aea36253ad9cc0fbe73066c271ee01035141e3ee6acff3f3be6e6c7b579b5759
tomcat-admin-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 65000ecee4fe1ba4b42986f8d739dd25843e921223eab4792a0933ad7fa9cb3c
tomcat-docs-webapp-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 8293906803c51af7d25193e7782bf3a1c20560e7eb60badf76d2d55dd8243e17
tomcat-el-3.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: c81598141b6eb0eb4763132492208eab8491cecc99f13500fbf3cea8eac093f2
tomcat-jsp-2.3-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 321a6d5087d33a258dbc3c1077c04edf1a2dee81cd9f2856d1b828d02edd69cb
tomcat-lib-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 6d1585b0756ed45d4e272b9af781606a9fe85f6e53fb4de4914b645368885436
tomcat-servlet-4.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 391210040103eb03e2e84bbc28358f9b97ba18a247cde12003dec1cb9a5b5ad0
tomcat-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 43a5b570ec11d0363b8d06092777db8f308d3db1c9f73f63aa454102d3fc3fb6

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8

SRPM
tomcat-9.0.87-1.el8_8.4.src.rpm SHA-256: da848b2d5eef546f6269f33ea3ab2a64f22cb30f1e87da2214ebc1bc9be39aee
s390x
tomcat-9.0.87-1.el8_8.4.noarch.rpm SHA-256: aea36253ad9cc0fbe73066c271ee01035141e3ee6acff3f3be6e6c7b579b5759
tomcat-admin-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 65000ecee4fe1ba4b42986f8d739dd25843e921223eab4792a0933ad7fa9cb3c
tomcat-docs-webapp-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 8293906803c51af7d25193e7782bf3a1c20560e7eb60badf76d2d55dd8243e17
tomcat-el-3.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: c81598141b6eb0eb4763132492208eab8491cecc99f13500fbf3cea8eac093f2
tomcat-jsp-2.3-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 321a6d5087d33a258dbc3c1077c04edf1a2dee81cd9f2856d1b828d02edd69cb
tomcat-lib-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 6d1585b0756ed45d4e272b9af781606a9fe85f6e53fb4de4914b645368885436
tomcat-servlet-4.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 391210040103eb03e2e84bbc28358f9b97ba18a247cde12003dec1cb9a5b5ad0
tomcat-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 43a5b570ec11d0363b8d06092777db8f308d3db1c9f73f63aa454102d3fc3fb6

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8

SRPM
tomcat-9.0.87-1.el8_8.4.src.rpm SHA-256: da848b2d5eef546f6269f33ea3ab2a64f22cb30f1e87da2214ebc1bc9be39aee
ppc64le
tomcat-9.0.87-1.el8_8.4.noarch.rpm SHA-256: aea36253ad9cc0fbe73066c271ee01035141e3ee6acff3f3be6e6c7b579b5759
tomcat-admin-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 65000ecee4fe1ba4b42986f8d739dd25843e921223eab4792a0933ad7fa9cb3c
tomcat-docs-webapp-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 8293906803c51af7d25193e7782bf3a1c20560e7eb60badf76d2d55dd8243e17
tomcat-el-3.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: c81598141b6eb0eb4763132492208eab8491cecc99f13500fbf3cea8eac093f2
tomcat-jsp-2.3-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 321a6d5087d33a258dbc3c1077c04edf1a2dee81cd9f2856d1b828d02edd69cb
tomcat-lib-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 6d1585b0756ed45d4e272b9af781606a9fe85f6e53fb4de4914b645368885436
tomcat-servlet-4.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 391210040103eb03e2e84bbc28358f9b97ba18a247cde12003dec1cb9a5b5ad0
tomcat-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 43a5b570ec11d0363b8d06092777db8f308d3db1c9f73f63aa454102d3fc3fb6

Red Hat Enterprise Linux Server - TUS 8.8

SRPM
tomcat-9.0.87-1.el8_8.4.src.rpm SHA-256: da848b2d5eef546f6269f33ea3ab2a64f22cb30f1e87da2214ebc1bc9be39aee
x86_64
tomcat-9.0.87-1.el8_8.4.noarch.rpm SHA-256: aea36253ad9cc0fbe73066c271ee01035141e3ee6acff3f3be6e6c7b579b5759
tomcat-admin-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 65000ecee4fe1ba4b42986f8d739dd25843e921223eab4792a0933ad7fa9cb3c
tomcat-docs-webapp-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 8293906803c51af7d25193e7782bf3a1c20560e7eb60badf76d2d55dd8243e17
tomcat-el-3.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: c81598141b6eb0eb4763132492208eab8491cecc99f13500fbf3cea8eac093f2
tomcat-jsp-2.3-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 321a6d5087d33a258dbc3c1077c04edf1a2dee81cd9f2856d1b828d02edd69cb
tomcat-lib-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 6d1585b0756ed45d4e272b9af781606a9fe85f6e53fb4de4914b645368885436
tomcat-servlet-4.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 391210040103eb03e2e84bbc28358f9b97ba18a247cde12003dec1cb9a5b5ad0
tomcat-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 43a5b570ec11d0363b8d06092777db8f308d3db1c9f73f63aa454102d3fc3fb6

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8

SRPM
tomcat-9.0.87-1.el8_8.4.src.rpm SHA-256: da848b2d5eef546f6269f33ea3ab2a64f22cb30f1e87da2214ebc1bc9be39aee
aarch64
tomcat-9.0.87-1.el8_8.4.noarch.rpm SHA-256: aea36253ad9cc0fbe73066c271ee01035141e3ee6acff3f3be6e6c7b579b5759
tomcat-admin-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 65000ecee4fe1ba4b42986f8d739dd25843e921223eab4792a0933ad7fa9cb3c
tomcat-docs-webapp-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 8293906803c51af7d25193e7782bf3a1c20560e7eb60badf76d2d55dd8243e17
tomcat-el-3.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: c81598141b6eb0eb4763132492208eab8491cecc99f13500fbf3cea8eac093f2
tomcat-jsp-2.3-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 321a6d5087d33a258dbc3c1077c04edf1a2dee81cd9f2856d1b828d02edd69cb
tomcat-lib-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 6d1585b0756ed45d4e272b9af781606a9fe85f6e53fb4de4914b645368885436
tomcat-servlet-4.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 391210040103eb03e2e84bbc28358f9b97ba18a247cde12003dec1cb9a5b5ad0
tomcat-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 43a5b570ec11d0363b8d06092777db8f308d3db1c9f73f63aa454102d3fc3fb6

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8

SRPM
tomcat-9.0.87-1.el8_8.4.src.rpm SHA-256: da848b2d5eef546f6269f33ea3ab2a64f22cb30f1e87da2214ebc1bc9be39aee
ppc64le
tomcat-9.0.87-1.el8_8.4.noarch.rpm SHA-256: aea36253ad9cc0fbe73066c271ee01035141e3ee6acff3f3be6e6c7b579b5759
tomcat-admin-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 65000ecee4fe1ba4b42986f8d739dd25843e921223eab4792a0933ad7fa9cb3c
tomcat-docs-webapp-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 8293906803c51af7d25193e7782bf3a1c20560e7eb60badf76d2d55dd8243e17
tomcat-el-3.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: c81598141b6eb0eb4763132492208eab8491cecc99f13500fbf3cea8eac093f2
tomcat-jsp-2.3-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 321a6d5087d33a258dbc3c1077c04edf1a2dee81cd9f2856d1b828d02edd69cb
tomcat-lib-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 6d1585b0756ed45d4e272b9af781606a9fe85f6e53fb4de4914b645368885436
tomcat-servlet-4.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 391210040103eb03e2e84bbc28358f9b97ba18a247cde12003dec1cb9a5b5ad0
tomcat-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 43a5b570ec11d0363b8d06092777db8f308d3db1c9f73f63aa454102d3fc3fb6

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8

SRPM
tomcat-9.0.87-1.el8_8.4.src.rpm SHA-256: da848b2d5eef546f6269f33ea3ab2a64f22cb30f1e87da2214ebc1bc9be39aee
x86_64
tomcat-9.0.87-1.el8_8.4.noarch.rpm SHA-256: aea36253ad9cc0fbe73066c271ee01035141e3ee6acff3f3be6e6c7b579b5759
tomcat-admin-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 65000ecee4fe1ba4b42986f8d739dd25843e921223eab4792a0933ad7fa9cb3c
tomcat-docs-webapp-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 8293906803c51af7d25193e7782bf3a1c20560e7eb60badf76d2d55dd8243e17
tomcat-el-3.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: c81598141b6eb0eb4763132492208eab8491cecc99f13500fbf3cea8eac093f2
tomcat-jsp-2.3-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 321a6d5087d33a258dbc3c1077c04edf1a2dee81cd9f2856d1b828d02edd69cb
tomcat-lib-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 6d1585b0756ed45d4e272b9af781606a9fe85f6e53fb4de4914b645368885436
tomcat-servlet-4.0-api-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 391210040103eb03e2e84bbc28358f9b97ba18a247cde12003dec1cb9a5b5ad0
tomcat-webapps-9.0.87-1.el8_8.4.noarch.rpm SHA-256: 43a5b570ec11d0363b8d06092777db8f308d3db1c9f73f63aa454102d3fc3fb6

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.