Red Hat Security Advisory: tomcat security update

This advisory covers two security fixes for Apache Tomcat in Red Hat Enterprise Linux 9.4 EUS. CVE-2024-50379 is an RCE vulnerability caused by a TOCTOU race condition during JSP compilation. CVE-2025-24813 involves potential remote code execution, information disclosure, or corruption triggered by partial PUT HTTP requests. Red Hat has released updated tomcat packages (version 9.0.87-1.el9_4.3) to address these vulnerabilities. The advisory includes multiple builds for different architectures and variants of Red Hat Enterprise Linux 9.4. No CVSS scores are provided in the advisory, but the impact is rated moderate.

Successful exploitation of CVE-2024-50379 could allow an attacker to execute arbitrary code remotely due to a race condition in JSP compilation. CVE-2025-24813 could lead to remote code execution, information disclosure, or data corruption through specially crafted partial PUT requests. These vulnerabilities affect systems running the specified vulnerable versions of Apache Tomcat on Red Hat Enterprise Linux 9.4 EUS. The impact is considered moderate by Red Hat Product Security.

Red Hat has released updated tomcat packages (version 9.0.87-1.el9_4.3) that fix these vulnerabilities. Users should apply the provided security update as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the issues. No additional mitigation steps are indicated or required beyond applying the official update.