From 564c630bd5bf6ed16bb97afa1f5a748f1494dde7 Mon Sep 17 00:00:00 2001
From: Adam Krajcik <akrajcik@redhat.com>
Date: Tue, 12 Aug 2025 15:48:56 +0200
Subject: [PATCH] Fix multiple CVES

Resolves: RHEL-108489 - CVE-2025-48976
Resolves: RHEL-108497 - CVE-2025-48988
Resolves: RHEL-108505 - CVE-2025-49125
Resolves: RHEL-108513 - CVE-2025-52434
Resolves: RHEL-108529 - CVE-2025-52520
Resolves: RHEL-108523 - CVE-2025-53506
---
 .gitignore  |  1 +
 sources     |  2 +-
 tomcat.spec | 18 ++++++++++++++++--
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index c2a9275..c6f51d1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,3 +11,4 @@ apache-tomcat-*-src/
 /tomcat-9.0.87.redhat-00005-src.zip
 /tomcat-9.0.87.redhat-00008-src.zip
 /tomcat-9.0.87.redhat-00010-src.zip
+/tomcat-9.0.87.redhat-00011-src.zip
diff --git a/sources b/sources
index 7a0d3a5..4e080da 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (tomcat-9.0.87.redhat-00010-src.zip) = fd65e91c2fd11d48396692e0e88fbba8c2025ec35cbefb29b9b192c516af958ad357a1232e21abd262187d14add45b1441c34d3fa76ac40ba0866febbbfb341d
+SHA512 (tomcat-9.0.87.redhat-00011-src.zip) = a5cd593edb6925ab9bc123faa2476815e61f31a3d22962149c041861bacfeba15fff77d3c56565e8283177fcdc84cf2d1b70b6a60732e9bab154f36cf438912a
diff --git a/tomcat.spec b/tomcat.spec
index 2c3f12f..9143ad9 100644
--- a/tomcat.spec
+++ b/tomcat.spec
@@ -32,7 +32,7 @@
 %global major_version 9
 %global minor_version 0
 %global micro_version 87
-%global packdname %{name}-%{major_version}.%{minor_version}.%{micro_version}.redhat-00010-src
+%global packdname %{name}-%{major_version}.%{minor_version}.%{micro_version}.redhat-00011-src
 %global servletspec 4.0
 %global elspec 3.0
 %global tcuid 53
@@ -56,7 +56,7 @@
 Name:          tomcat
 Epoch:         1
 Version:       %{major_version}.%{minor_version}.%{micro_version}
-Release:       4%{?dist}
+Release:       5%{?dist}
 Summary:       Apache Servlet/JSP Engine, RI for Servlet %{servletspec}/JSP %{jspspec} API
 
 License:       ASL 2.0
@@ -557,6 +557,20 @@ fi
 
 
 %changelog
+* Tue Aug 12 2025 Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-5
+- Resolves: RHEL-108489
+  tomcat: Apache Commons FileUpload DOS via part headers (CVE-2025-48976)
+- Resolves: RHEL-108497
+  tomcat: Dos in multipart upload (CVE-2025-48988)
+- Resolves: RHEL-108505
+  tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
+- Resolves: RHEL-108513
+  tomcat: Denial of service (CVE-2025-52434)
+- Resolves: RHEL-108529
+  tomcat: Denial of service (CVE-2025-52520)
+- Resolves: RHEL-108523
+  tomcat: Denial of service (CVE-2025-53506)
+
 * Mon Jul 21 2025 Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-4
 - Resolves: RHEL-91763
   tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650)