SUSE-SU-2025:1521-1

Опубликовано: 09 мая 2025

Источник: suse-cvrf

Описание

Security update for tomcat

This update for tomcat fixes the following issues:

Update to Tomcat 9.0.104

CVE-2025-31650: invalid priority field values should be ignored (bsc#1242008)
CVE-2025-31651: Better handling of URLs with literal ';' and '?' (bsc#1242009)

Full changelog:

https://tomcat.apache.org/tomcat-9.0-doc/changelog.htm

Список пакетов

Container suse/manager/5.0/x86_64/server:latest

tomcat-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

SUSE Enterprise Storage 7.1

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Linux Enterprise Module for Web and Scripting 15 SP6

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Linux Enterprise Server 15 SP3-LTSS

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Linux Enterprise Server 15 SP4-LTSS

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Linux Enterprise Server 15 SP5-LTSS

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Linux Enterprise Server for SAP Applications 15 SP3

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Linux Enterprise Server for SAP Applications 15 SP4

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Linux Enterprise Server for SAP Applications 15 SP5

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

SUSE Manager Server 4.3

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

openSUSE Leap 15.6

tomcat-9.0.104-150200.81.1

tomcat-admin-webapps-9.0.104-150200.81.1

tomcat-docs-webapp-9.0.104-150200.81.1

tomcat-el-3_0-api-9.0.104-150200.81.1

tomcat-embed-9.0.104-150200.81.1

tomcat-javadoc-9.0.104-150200.81.1

tomcat-jsp-2_3-api-9.0.104-150200.81.1

tomcat-jsvc-9.0.104-150200.81.1

tomcat-lib-9.0.104-150200.81.1

tomcat-servlet-4_0-api-9.0.104-150200.81.1

tomcat-webapps-9.0.104-150200.81.1

Ссылки

https://www.suse.com/support/update/announcement/2025/suse-su-20251521-1/
Link for SUSE-SU-2025:1521-1
https://lists.suse.com/pipermail/sle-security-updates/2025-May/020814.html
E-Mail link for SUSE-SU-2025:1521-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
https://bugzilla.suse.com/1242008
SUSE Bug 1242008
https://bugzilla.suse.com/1242009
SUSE Bug 1242009
https://www.suse.com/security/cve/CVE-2025-31650/
SUSE CVE CVE-2025-31650 page
https://www.suse.com/security/cve/CVE-2025-31651/
SUSE CVE CVE-2025-31651 page

Описание

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

Затронутые продукты

Container suse/manager/5.0/x86_64/server:latest:tomcat-9.0.104-150200.81.1

Container suse/manager/5.0/x86_64/server:latest:tomcat-el-3_0-api-9.0.104-150200.81.1

Container suse/manager/5.0/x86_64/server:latest:tomcat-jsp-2_3-api-9.0.104-150200.81.1

Container suse/manager/5.0/x86_64/server:latest:tomcat-lib-9.0.104-150200.81.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-31650.html
CVE-2025-31650
https://bugzilla.suse.com/1242008
SUSE Bug 1242008

Описание

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Затронутые продукты

Container suse/manager/5.0/x86_64/server:latest:tomcat-9.0.104-150200.81.1

Container suse/manager/5.0/x86_64/server:latest:tomcat-el-3_0-api-9.0.104-150200.81.1

Container suse/manager/5.0/x86_64/server:latest:tomcat-jsp-2_3-api-9.0.104-150200.81.1

Container suse/manager/5.0/x86_64/server:latest:tomcat-lib-9.0.104-150200.81.1

Ссылки

https://www.suse.com/security/cve/CVE-2025-31651.html
CVE-2025-31651
https://bugzilla.suse.com/1242009
SUSE Bug 1242009

SUSE-SU-2025:1521-1

Описание

Список пакетов

Container suse/manager/5.0/x86_64/server:latest

SUSE Enterprise Storage 7.1

SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS

SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS

SUSE Linux Enterprise Module for Web and Scripting 15 SP6

SUSE Linux Enterprise Server 15 SP3-LTSS

SUSE Linux Enterprise Server 15 SP4-LTSS

SUSE Linux Enterprise Server 15 SP5-LTSS

SUSE Linux Enterprise Server for SAP Applications 15 SP3

SUSE Linux Enterprise Server for SAP Applications 15 SP4

SUSE Linux Enterprise Server for SAP Applications 15 SP5

SUSE Manager Server 4.3

openSUSE Leap 15.6

Ссылки

Уязвимость: CVE-2025-31650

Описание

Затронутые продукты

Ссылки

Уязвимость: CVE-2025-31651

Описание

Затронутые продукты

Ссылки