From 4c6f5230c73a3177b9c8f4489dc019d446a17919 Mon Sep 17 00:00:00 2001 From: Adam Krajcik Date: Thu, 14 Aug 2025 14:22:32 +0200 Subject: [PATCH] Fix CVE-2025-48989 and CVE-2025-52520 Resolves: RHEL-102184 - tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames Resolves: RHEL-108906 - tomcat: Denial of service --- sources | 2 +- tomcat.spec | 10 ++++++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/sources b/sources index aff5a82..c3c9515 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (tomcat-10.1.36.redhat-00008-src.zip) = cdfcacf770c4c2f265b33fb88299ea98994fc79d1eb0eb20c7b2b166937179c8690bb4706208311e57c15e08b96809b97b6ca5d99b2182741b106edb46e81bec +SHA512 (tomcat-10.1.36.redhat-00009-src.zip) = d1a9f6ef73d5ce3df746decd6033bbdc7e81a0a37e01c530e8658cb9dbf8742ca1ddb7916534a0e07572b514f8bfe557314aae61aa577c09a356ac399d653974 diff --git a/tomcat.spec b/tomcat.spec index 1bafdc9..4006c9d 100644 --- a/tomcat.spec +++ b/tomcat.spec @@ -32,7 +32,7 @@ %global major_version 10 %global minor_version 1 %global micro_version 36 -%global packdname %{name}-%{major_version}.%{minor_version}.%{micro_version}.redhat-00008-src +%global packdname %{name}-%{major_version}.%{minor_version}.%{micro_version}.redhat-00009-src %global servletspec 6.0 %global elspec 5.0 %global tcuid 53 @@ -54,7 +54,7 @@ Name: tomcat Epoch: 1 Version: %{major_version}.%{minor_version}.%{micro_version} -Release: 2%{?dist} +Release: 3%{?dist} Summary: Apache Servlet/JSP Engine, RI for Servlet %{servletspec}/JSP %{jspspec} API License: Apache-2.0 @@ -543,6 +543,12 @@ exit 0 %{appdir}/ROOT %changelog +* Thu Aug 14 2025 Adam Krajcik - 1:10.1.36-3 +- Resolves: RHEL-102184 + tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989) +- Resolves: RHEL-108906 + tomcat: Denial of service (CVE-2025-52520) + * Wed Aug 13 2025 Adam Krajcik - 1:10.1.36-2 - Resolves: RHEL-108900 tomcat: Apache FileUpload DOS via part headers (CVE-2025-48976)