Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:01882-1

Опубликовано: 11 июн. 2025
Источник: suse-cvrf

Описание

Security update for tomcat

This update for tomcat fixes the following issues:

  • CVE-2025-31651: Better handling of URLs with literal ';' and '?' (bsc#1242009).

Список пакетов

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
tomcat-9.0.36-3.142.1
tomcat-admin-webapps-9.0.36-3.142.1
tomcat-docs-webapp-9.0.36-3.142.1
tomcat-el-3_0-api-9.0.36-3.142.1
tomcat-javadoc-9.0.36-3.142.1
tomcat-jsp-2_3-api-9.0.36-3.142.1
tomcat-lib-9.0.36-3.142.1
tomcat-servlet-4_0-api-9.0.36-3.142.1
tomcat-webapps-9.0.36-3.142.1

Ссылки

Описание

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:tomcat-9.0.36-3.142.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:tomcat-admin-webapps-9.0.36-3.142.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:tomcat-docs-webapp-9.0.36-3.142.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:tomcat-el-3_0-api-9.0.36-3.142.1
Ссылки