Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

rocky логотип

RLSA-2026:18537

Опубликовано: 29 мая 2026
Источник: rocky
Оценка: Important

Описание

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat: Security constraint bypass for CGI scripts (CVE-2025-46701)

  • org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve (CVE-2025-55668)

  • org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation (CVE-2025-55754)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

Затронутые продукты

  • Rocky Linux 10

НаименованиеАрхитектураРелизRPM
tomcat-servlet-6.0-apinoarch1.el10_2.1tomcat-servlet-6.0-api-10.1.49-1.el10_2.1.noarch.rpm
tomcat-webappsnoarch1.el10_2.1tomcat-webapps-10.1.49-1.el10_2.1.noarch.rpm
tomcat-libnoarch1.el10_2.1tomcat-lib-10.1.49-1.el10_2.1.noarch.rpm
tomcat-jsp-3.1-apinoarch1.el10_2.1tomcat-jsp-3.1-api-10.1.49-1.el10_2.1.noarch.rpm
tomcat-admin-webappsnoarch1.el10_2.1tomcat-admin-webapps-10.1.49-1.el10_2.1.noarch.rpm
tomcatnoarch1.el10_2.1tomcat-10.1.49-1.el10_2.1.noarch.rpm
tomcat-el-5.0-apinoarch1.el10_2.1tomcat-el-5.0-api-10.1.49-1.el10_2.1.noarch.rpm
tomcat-docs-webappnoarch1.el10_2.1tomcat-docs-webapp-10.1.49-1.el10_2.1.noarch.rpm

Показывать по

Связанные CVE

CVE-2025-46701
CVE-2025-55668
CVE-2025-55754

Ссылки на источники

Исправления

Связанные уязвимости

oracle-oval логотип

ELSA-2026-18916

oracle-oval
около 1 месяца назад

ELSA-2026-18916: tomcat security update (IMPORTANT)

oracle-oval логотип

ELSA-2026-18537

oracle-oval
10 дней назад

ELSA-2026-18537: tomcat security update (IMPORTANT)

oracle-oval логотип

ELSA-2026-18536

oracle-oval
10 дней назад

ELSA-2026-18536: tomcat9 security update (IMPORTANT)

ubuntu логотип

CVE-2025-46701

CVSS3: 7.3
ubuntu
около 1 года назад

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

redhat логотип

CVE-2025-46701

CVSS3: 6.5
redhat
около 1 года назад

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.