[ALSA-2025:23052] Important: tomcat9 security update
Type:
security
Severity:
important
Release date:
2025-12-17
Description:
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world. Security Fix(es): * tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651) * tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
Architecture Package Checksum
noarch tomcat9-jsp-2.3-api-9.0.87-8.el10_1.1.noarch.rpm 06b9ffb04a18b2c62901d425e1a577f385bdbb5f3dca4fb05a64c0a05b8917cb
noarch tomcat9-el-3.0-api-9.0.87-8.el10_1.1.noarch.rpm 1835f0bc3ca9b3201e899a9e8d7801418412d8651d0b502ce2d0f19e62c6b063
noarch tomcat9-servlet-4.0-api-9.0.87-8.el10_1.1.noarch.rpm 44e7a8721279cb2fff33fdf94aae06088663ef8b818471da1389b9216a066586
noarch tomcat9-lib-9.0.87-8.el10_1.1.noarch.rpm 5fbb9c0ce4fb1f0f3c001cd13ba638bde0f0f6cbaaf11fe7c9e4a88c4b669bc6
noarch tomcat9-9.0.87-8.el10_1.1.noarch.rpm bbc04103b9f730b9ed20d3c6b9089fb5c015604ea2815e2e78a339d2e9b17104
noarch tomcat9-admin-webapps-9.0.87-8.el10_1.1.noarch.rpm d12b701fa61c7e1d606284dcc6feb6ec7b957679be81aa5ba3a8fceb2e320fe0
noarch tomcat9-webapps-9.0.87-8.el10_1.1.noarch.rpm d267a9c403d045721056b9f62d6d5a58e8d3aa3e524d568d19eb12345e211daf
noarch tomcat9-docs-webapp-9.0.87-8.el10_1.1.noarch.rpm f626d6d4f19cb1b6ba26ac4fa47d563ace20bd4439b1d5b4d4f55d7d6d7ccd4c
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.