rpms/tomcat9
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2025-55752 and CVE-2025-31651

Browse Source 
Resolves: RHEL-124496 - tomcat: Directory traversal via rewrite with possible RCE
Resolves: RHEL-132559 - tomcat: Bypass of rules in Rewrite Valve
This commit is contained in:
Adam Krajcik 2025-11-28 14:07:00 +01:00 committed by pmeloni
parent ab17886acb
commit eb8ee63e74
3 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -4,3 +4,4 @@
/tomcat-9.0.87.redhat-00010-src.zip
/tomcat-9.0.87.redhat-00011-src.zip
/tomcat-9.0.87.redhat-00012-src.zip
/tomcat-9.0.87.redhat-00013-src.zip

2
sources
View File

@ -1 +1 @@
SHA512 (tomcat-9.0.87.redhat-00012-src.zip) = 09c490294696114a2fd1c0680db96c969a331d070d1855ae4814bea5d57f9e891d6576b4acae56f53864280e53c3e6983c2b1a11861b0b0f52c021048482c696
SHA512 (tomcat-9.0.87.redhat-00013-src.zip) = 1049d86d4bbdfd251a3f0cc72840cb6535a5637a76becaec8cb9c6532430dabaefd007af285fa1ac8d6a2a70f1d0378f6a1e908f7e7c5aff7c2bbedcd521cc9d

10
tomcat9.spec
View File

@ -32,7 +32,7 @@
%global major_version 9
%global minor_version 0
%global micro_version 87
%global packdname tomcat-%{major_version}.%{minor_version}.%{micro_version}.redhat-00012-src
%global packdname tomcat-%{major_version}.%{minor_version}.%{micro_version}.redhat-00013-src
%global servletspec 4.0
%global elspec 3.0
%global tcuid 53
@ -53,7 +53,7 @@
Name: tomcat9
Epoch: 1
Version: %{major_version}.%{minor_version}.%{micro_version}
Release: 8%{?dist}
Release: 9%{?dist}
Summary: Apache Servlet/JSP Engine, RI for Servlet %{servletspec}/JSP %{jspspec} API
License: Apache-2.0
@ -622,6 +622,12 @@ fi
%{appdir}/ROOT
%changelog
* Fri Jan 23 2026 Pietro Meloni <pmeloni@redhat.com> - 1:9.0.87-9
- Resolves: RHEL-124496
tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)
- Resolves: RHEL-132559
tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)
* Mon Aug 18 2025 Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-8
- Resolves: RHEL-102186
tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)