Red Hat Security Advisory: tomcat security update

Red Hat Enterprise Linux 9's Tomcat package contains two vulnerabilities: CVE-2024-50379, an RCE vulnerability due to a TOCTOU flaw in JSP compilation, and CVE-2025-24813, which involves potential RCE, information disclosure, or corruption via partial PUT requests. These issues affect Tomcat versions from 9.0.0 up to but not including 9.0.87-2.el9_5.1. Red Hat has issued a security advisory (RHSA-2025:3645) and released patched packages to mitigate these vulnerabilities.

Successful exploitation of CVE-2024-50379 could allow remote code execution through a race condition in JSP compilation. CVE-2025-24813 could lead to remote code execution, information disclosure, or data corruption via partial PUT HTTP requests. Both vulnerabilities pose a moderate security risk as rated by Red Hat, potentially allowing attackers to execute arbitrary code or access sensitive information on affected systems.

Red Hat has released updated Tomcat packages (version 9.0.87-2.el9_5.1) that fix these vulnerabilities. Users of Red Hat Enterprise Linux 9 should apply the provided security update promptly following Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.