Red Hat Security Advisory: tomcat security update

This advisory covers two security fixes for Apache Tomcat in Red Hat Enterprise Linux 8.8 EUS. CVE-2024-50379 is an RCE vulnerability caused by a TOCTOU race condition during JSP compilation. CVE-2025-24813 involves potential remote code execution, information disclosure, or data corruption triggered by partial HTTP PUT requests. The vendor has released patched Tomcat packages (version 9.0.87-1.el8_8.4) to address these issues. The advisory rates the impact as moderate and provides detailed update instructions.

Successful exploitation of CVE-2024-50379 could allow an attacker to execute arbitrary code remotely due to a race condition in JSP compilation. CVE-2025-24813 could lead to remote code execution, unauthorized information disclosure, or corruption of data through crafted partial PUT requests. Both vulnerabilities pose a risk to the confidentiality, integrity, and availability of affected systems running vulnerable Tomcat versions.

Red Hat has released updated Tomcat packages (version 9.0.87-1.el8_8.4) for Red Hat Enterprise Linux 8.8 Extended Update Support that fix these vulnerabilities. Users should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patches.