Red Hat Product Errata RHSA-2025:4521 - Security Advisory
Issued:
2025-05-08
Updated:
2025-05-19

RHSA-2025:4521 - Security Advisory

Synopsis

Important: Red Hat JBoss Web Server 5.8.4 release and security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Web Server 5.8 on Red Hat Enterprise Linux versions 7, 8, and 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 5.8.4 serves as a replacement for Red Hat JBoss Web Server 5.8.3. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.

Security Fix(es):

  • tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation [jws-5] (CVE-2024-56337)
  • tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame [jws-5] (CVE-2025-31650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Web Server 5 for RHEL 9 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 8 x86_64
  • JBoss Enterprise Web Server 5 for RHEL 7 x86_64

Fixes

  • BZ - 2333521 - CVE-2024-56337 tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation
  • BZ - 2362783 - CVE-2025-31650 tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

JBoss Enterprise Web Server 5 for RHEL 9

SRPM
jws5-tomcat-9.0.87-11.redhat_00010.1.el9jws.src.rpm SHA-256: ea63377b66de5a67b718138c2f7a7b621a0322eab79bd5386a436ad4a63ca6cd
x86_64
jws5-tomcat-9.0.87-11.redhat_00010.1.el9jws.noarch.rpm SHA-256: 94ea98c7dd6535398fbd3aed04df29afa9ae5c9ca9aca2747f28bb8460b4880d
jws5-tomcat-admin-webapps-9.0.87-11.redhat_00010.1.el9jws.noarch.rpm SHA-256: 3cc3f5f2f588a86775ba240cd1a7f174b06958a223e4ef1013f4ac29c2ae9b53
jws5-tomcat-docs-webapp-9.0.87-11.redhat_00010.1.el9jws.noarch.rpm SHA-256: 6a0b669665b3ea344cdde4d359bea2d9c17ea88b3bb03b729c84a345dc4145d7
jws5-tomcat-el-3.0-api-9.0.87-11.redhat_00010.1.el9jws.noarch.rpm SHA-256: d9dddeb0a2c5379cc67a7c177c8377eaec5fd817dfa441ca0e823faa23ce3e80
jws5-tomcat-javadoc-9.0.87-11.redhat_00010.1.el9jws.noarch.rpm SHA-256: 8578da846f567367a2c231acb752157b03f719b7a362a92c1f52d68b28ce9cb7
jws5-tomcat-jsp-2.3-api-9.0.87-11.redhat_00010.1.el9jws.noarch.rpm SHA-256: 14aac479143df7289d0adf44c73a6d239dde78a44b52672f4db05fd5a2757824
jws5-tomcat-lib-9.0.87-11.redhat_00010.1.el9jws.noarch.rpm SHA-256: 165127e01ea696ed602840f6b3e35ff358f9616d0452663aec42759a193d868a
jws5-tomcat-selinux-9.0.87-11.redhat_00010.1.el9jws.noarch.rpm SHA-256: 4a197300513141fc786d80f28701d9cdeae533b49655edfdb75082df5927fdf0
jws5-tomcat-servlet-4.0-api-9.0.87-11.redhat_00010.1.el9jws.noarch.rpm SHA-256: 939a1424615660969b270a38124f0fbbb51b6ea1c019002519d01bf17bb29b12
jws5-tomcat-webapps-9.0.87-11.redhat_00010.1.el9jws.noarch.rpm SHA-256: 4cf26eb509c8ef2c7294301e2314327f661e453f834a58022d833f8789ad8502

JBoss Enterprise Web Server 5 for RHEL 8

SRPM
jws5-tomcat-9.0.87-11.redhat_00010.1.el8jws.src.rpm SHA-256: 96e6fa1e3d9d2daa0c33cabe90ac24c3d8eac68f11513952f083c09ee0292da8
x86_64
jws5-tomcat-9.0.87-11.redhat_00010.1.el8jws.noarch.rpm SHA-256: f659f251cd1a78a7cf632835930c0848d2fa3a253cf037f3ff99026740c4d94f
jws5-tomcat-admin-webapps-9.0.87-11.redhat_00010.1.el8jws.noarch.rpm SHA-256: e01e705f044bf0fff16356d7b60ee55831c461d5790dd2df9acc2bc4a890df92
jws5-tomcat-docs-webapp-9.0.87-11.redhat_00010.1.el8jws.noarch.rpm SHA-256: 0ee445ce4202b1c00dada0765220c6bd3cf7fcae7d7931659c3a98080b6573f4
jws5-tomcat-el-3.0-api-9.0.87-11.redhat_00010.1.el8jws.noarch.rpm SHA-256: b9a5dde08a5986acf04e65c53b607558956128c313f5ef925c9761f52486cc06
jws5-tomcat-javadoc-9.0.87-11.redhat_00010.1.el8jws.noarch.rpm SHA-256: 282561dd2dfacd8c0a856333741dccf0c52e7a2f7250102dfb6f72893dac4860
jws5-tomcat-jsp-2.3-api-9.0.87-11.redhat_00010.1.el8jws.noarch.rpm SHA-256: 027085a825b2c21c74c702e110ace784c805502eaa0faaa58f0cd568ec073dd6
jws5-tomcat-lib-9.0.87-11.redhat_00010.1.el8jws.noarch.rpm SHA-256: b654ea1d4ca5fb50c2838297fcc99ef3ecaf9755c681e8b4f5c0afd1c64b1465
jws5-tomcat-selinux-9.0.87-11.redhat_00010.1.el8jws.noarch.rpm SHA-256: 4d3c06cc1906573ed11c2412ccd52cdda282fe0489cff2c53f2f88f6400a0b20
jws5-tomcat-servlet-4.0-api-9.0.87-11.redhat_00010.1.el8jws.noarch.rpm SHA-256: 280eabae36d575ca1f99c123efd96ed16bc599ef3ca10f6c21355d8d8c1184d6
jws5-tomcat-webapps-9.0.87-11.redhat_00010.1.el8jws.noarch.rpm SHA-256: a79c69e5f4862046c0f067071b59d1548acf95025095f1041fa4a2946bfceffb

JBoss Enterprise Web Server 5 for RHEL 7

SRPM
jws5-tomcat-9.0.87-11.redhat_00010.1.el7jws.src.rpm SHA-256: e376d2844ebdb26fe8e9d758f4696c671209a31842e4a0b1f78b97e2890aaf87
x86_64
jws5-tomcat-9.0.87-11.redhat_00010.1.el7jws.noarch.rpm SHA-256: 9d37919129032dd931c85f22dc608e0f11359e3966c483e69f2f27625e37ace5
jws5-tomcat-admin-webapps-9.0.87-11.redhat_00010.1.el7jws.noarch.rpm SHA-256: 96716af86357009d2878e13d3d3177a5f7b23a7b699ba9f89b970101a19aa425
jws5-tomcat-docs-webapp-9.0.87-11.redhat_00010.1.el7jws.noarch.rpm SHA-256: c6c91bb417bc664f4c2e6efbb38226b08aa47d18108e349184ea22fb1acfa15b
jws5-tomcat-el-3.0-api-9.0.87-11.redhat_00010.1.el7jws.noarch.rpm SHA-256: 44d3246ff636ca5de3fa8265979a498a883acc4f31e8cdcc42d286a49376c21e
jws5-tomcat-java-jdk11-9.0.87-11.redhat_00010.1.el7jws.noarch.rpm SHA-256: 8f0f900075075657a73c7d65de5db4d6a8e8c970b216a4fd7f7203f8375d62b4
jws5-tomcat-java-jdk8-9.0.87-11.redhat_00010.1.el7jws.noarch.rpm SHA-256: 750c5a59a2ce451ba15f7b7cdb1d9ef24a9adff8cb9b31ff088af163549f031a
jws5-tomcat-javadoc-9.0.87-11.redhat_00010.1.el7jws.noarch.rpm SHA-256: 6f0167d8846f4ff5415b2946c72ad41a14ec624231e0f85529a7a71181a2598b
jws5-tomcat-jsp-2.3-api-9.0.87-11.redhat_00010.1.el7jws.noarch.rpm SHA-256: aa100c724099d4bb7c8fc02d370b3b8ad0d58e7787d58e5899163de0527f203b
jws5-tomcat-lib-9.0.87-11.redhat_00010.1.el7jws.noarch.rpm SHA-256: 3ecb84b7f7e725a69811baf3d3d65081ac6c49d63fc1dae969e4a6eabf68bdc5
jws5-tomcat-selinux-9.0.87-11.redhat_00010.1.el7jws.noarch.rpm SHA-256: c9d766087735307a2b0961392a4f69914fde3307567ddb226bdcca7fec8f067b
jws5-tomcat-servlet-4.0-api-9.0.87-11.redhat_00010.1.el7jws.noarch.rpm SHA-256: 797593b52a73842a4a6c4446810cfcae4f718ac811a863433a1c4163925b1ba5
jws5-tomcat-webapps-9.0.87-11.redhat_00010.1.el7jws.noarch.rpm SHA-256: d386e8dd84429965bb4a07b9e9e35123a8b7e72e85ec24f489222c2347b7c1ad

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.