Red Hat Security Advisory: tomcat security update

This advisory covers two security fixes for Apache Tomcat in Red Hat Enterprise Linux 9.2 EUS. The first vulnerability (CVE-2024-50379) is an RCE due to a TOCTOU race condition during JSP compilation. The second (CVE-2025-24813) involves potential remote code execution, information disclosure, or corruption via partial HTTP PUT requests. Red Hat has released updated Tomcat packages (version 9.0.87-1.el9_2.3) to address these issues. The advisory rates the impact as moderate and provides detailed package updates for multiple architectures and variants of Red Hat Enterprise Linux 9.2.

Successful exploitation of CVE-2024-50379 could allow an attacker to execute arbitrary code remotely due to a race condition in JSP compilation. CVE-2025-24813 could enable remote code execution, information disclosure, or data corruption through crafted partial PUT requests. Both vulnerabilities pose a moderate security risk as rated by Red Hat. There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated Tomcat packages (version 9.0.87-1.el9_2.3) for Red Hat Enterprise Linux 9.2 Extended Update Support to fix these vulnerabilities. Users should apply these official updates as described in the Red Hat advisory (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated or required beyond applying the provided patches.