This advisory covers two security vulnerabilities in Apache Tomcat as packaged by Red Hat for Red Hat Enterprise Linux 8. CVE-2024-34750 relates to improper handling of exceptional conditions, which could lead to unexpected behavior or errors. CVE-2024-38286 is a denial of service vulnerability that could allow an attacker to disrupt Tomcat service availability. Red Hat has released updated Tomcat packages (version 9.0.87-1.el8_10.2) that address these issues. The advisory applies to multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS scores are provided in the advisory, but the severity is rated as important by Red Hat Product Security.

The vulnerabilities could lead to service disruption due to denial of service and improper error handling in Apache Tomcat. This may affect availability and stability of applications running on affected Tomcat versions within Red Hat Enterprise Linux 8 environments. No known exploits in the wild have been reported at this time.

Red Hat has released updated Tomcat packages that fix these vulnerabilities. Users should apply the security update for Tomcat as provided in Red Hat Enterprise Linux 8 repositories, specifically the tomcat-9.0.87-1.el8_10.2 package and related components. Refer to Red Hat article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation is indicated or required beyond applying the official update.