Summary
[1:10.1.36-3.el10_1.1]
- Resolves: RHEL-150719
Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
[1:10.1.49-1]
- Resolves: RHEL-150099 Rebase tomcat package to enable PQC features
[1:10.1.36-4]
- Resolves: RHEL-124493
tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)
- Resolves: RHEL-132560
tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)
- Resolves: RHEL-132526
tomcat: Denial of service (CVE-2025-61795)
[1:10.1.36-3]
- Resolves: RHEL-102184
tomcat: http/2 'MadeYouReset' DoS attack through HTTP/2 control frames (CVE-2025-48989)
- Resolves: RHEL-108906
tomcat: Denial of service (CVE-2025-52520)
[1:10.1.36-2]
- Resolves: RHEL-108900
tomcat: Apache FileUpload DOS via part headers (CVE-2025-48976)
- Resolves: RHEL-108902
tomcat: Dos in multipart upload (CVE-2025-48988)
- Resolves: RHEL-108904
tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)
- Resolves: RHEL-108908
tomcat: Denial of service (CVE-2025-53506)
[1:10.1.36-1]
- Rebase tomcat to 10.1.36
- Resolves: RHEL-82925
tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
- Resolves: RHEL-87272
tomcat: DoS in examples web application (CVE-2024-54677)
- Resolves: RHEL-87273
tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)
- Resolves: RHEL-85343 - NoClassDefFoundError when using migration tool
[1:10.1.8-2]
- Resolves: RHEL-78899 Add missing Obsoletes
[1:10.1.8-1]
- Resolves: RHEL-51222 Upgrade tomcat to 10.1.8
[1:9.0.87-3]
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018
[1:9.0.87-2]
- Resolves: RHEL-50166 - Rebase tomcat to version 9.0.87
- Resolves: RHEL-12274 - Use src.zip file as a Source0 instead of tar.gz
- Resolves: RHEL-51277 - Prune changelog to remove non-relevant history
- Resolves: RHEL-52906 - tomcat: Switch to using Java 21 as the default JDK
- Resolves: RHEL-55194 - Fix changelog version
- Resolves: RHEL-46156
tomcat: Improper Handling of Exceptional Conditions (CVE-2024-34750)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | tomcat | 1:10.1.49-1.el10_2.1 |
| Oracle Linux · 10 | tomcat-admin-webapps | 1:10.1.49-1.el10_2.1 |
| Oracle Linux · 10 | tomcat-docs-webapp | 1:10.1.49-1.el10_2.1 |
| Oracle Linux · 10 | tomcat-el-5.0-api | 1:10.1.49-1.el10_2.1 |
| Oracle Linux · 10 | tomcat-jsp-3.1-api | 1:10.1.49-1.el10_2.1 |
| Oracle Linux · 10 | tomcat-lib | 1:10.1.49-1.el10_2.1 |
| Oracle Linux · 10 | tomcat-servlet-6.0-api | 1:10.1.49-1.el10_2.1 |
| Oracle Linux · 10 | tomcat-webapps | 1:10.1.49-1.el10_2.1 |
Vulnerabilities 1
-
High 7.4
Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could al…