Red Hat Security Advisory: tomcat security update

Red Hat issued a security advisory for Apache Tomcat in Red Hat Enterprise Linux 8 addressing two vulnerabilities. CVE-2024-50379 is an RCE vulnerability due to a TOCTOU race condition in JSP compilation. CVE-2025-24813 involves potential RCE, information disclosure, or corruption triggered by partial HTTP PUT requests. These vulnerabilities affect Tomcat versions included in Red Hat Enterprise Linux 8 prior to 8.10.3. Red Hat has released updated Tomcat packages (version 9.0.87-1.el8_10.3) that remediate these issues. The advisory rates the security impact as Moderate and provides detailed package updates for multiple architectures.

Successful exploitation of CVE-2024-50379 could allow remote code execution via a race condition in JSP compilation. CVE-2025-24813 could lead to remote code execution, information disclosure, or data corruption through partial PUT HTTP requests. These vulnerabilities could compromise the confidentiality, integrity, and availability of affected systems running vulnerable Tomcat versions on Red Hat Enterprise Linux 8. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released official updates that fix these vulnerabilities in Tomcat packages for Red Hat Enterprise Linux 8. Users should apply the updated packages (e.g., tomcat-9.0.87-1.el8_10.3) as provided in the advisory to remediate these issues. Refer to Red Hat's update instructions at https://access.redhat.com/articles/11258 for detailed guidance. No additional mitigation steps are indicated by the vendor.