The advisory covers two security flaws in Apache Tomcat used within the pki-servlet-engine on Red Hat Enterprise Linux 9.2. CVE-2025-31651 involves a bypass of rules in the Tomcat Rewrite Valve, potentially allowing unintended request processing. CVE-2025-55752 is a directory traversal vulnerability via rewrite rules that could enable remote code execution. Red Hat has issued updated pki-servlet-engine packages (version 9.0.50-1.el9_2.3) to address these issues. The advisory rates the impact as Important (high severity) but does not provide CVSS scores. The vulnerabilities relate to CWE-150 (Improper Neutralization of Input During Web Page Generation) and CWE-23 (Relative Path Traversal).

Successful exploitation of CVE-2025-31651 could allow bypassing rewrite rules in Tomcat, potentially leading to unauthorized request handling. CVE-2025-55752 could allow an attacker to perform directory traversal via crafted rewrite rules, possibly resulting in remote code execution. These vulnerabilities affect systems running the affected versions of pki-servlet-engine on Red Hat Enterprise Linux 9.2 and related distributions, potentially compromising system integrity and confidentiality.

Red Hat has released updated pki-servlet-engine packages (version 9.0.50-1.el9_2.3) that fix these vulnerabilities. Users should apply these official updates promptly to remediate the issues. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.