Bug 34231 - tomcat new security issues CVE-2025-3165[01]
Summary: tomcat new security issues CVE-2025-3165[01]
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-04-29 09:15 CEST by Nicolas Salguero
Modified: 2025-05-05 06:58 CEST (History)
3 users (show)

See Also:
Source RPM: tomcat-9.0.102-1.mga9.src.rpm
CVE: CVE-2025-31650, CVE-2025-31651
Status comment:


Attachments

Description Nicolas Salguero 2025-04-29 09:15:37 CEST
CVE-2025-31650 was announced here:
https://www.openwall.com/lists/oss-security/2025/04/28/2
CVE-2025-31651 was announced here:
https://www.openwall.com/lists/oss-security/2025/04/28/3
Nicolas Salguero 2025-04-29 09:17:07 CEST

Status comment: (none) => Fixed upstream in 9.0.104
Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2025-31650, CVE-2025-31651
Source RPM: (none) => tomcat-9.0.102-1.mga10.src.rpm, tomcat-9.0.102-1.mga9.src.rpm

Comment 1 Nicolas Salguero 2025-04-29 14:21:45 CEST
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

DoS via malformed HTTP/2 PRIORITY_UPDATE frame. (CVE-2025-31650)

Bypass of rules in Rewrite Valve. (CVE-2025-31651)

References:
https://www.openwall.com/lists/oss-security/2025/04/28/2
https://www.openwall.com/lists/oss-security/2025/04/28/3
========================

Updated packages in core/updates_testing:
========================
tomcat-9.0.104-1.mga9
tomcat-admin-webapps-9.0.104-1.mga9
tomcat-docs-webapp-9.0.104-1.mga9
tomcat-el-3.0-api-9.0.104-1.mga9
tomcat-jsp-2.3-api-9.0.104-1.mga9
tomcat-lib-9.0.104-1.mga9
tomcat-servlet-4.0-api-9.0.104-1.mga9
tomcat-webapps-9.0.104-1.mga9

from SRPM:
tomcat-9.0.104-1.mga9.src.rpm

Assignee: bugsquad => qa-bugs
Status comment: Fixed upstream in 9.0.104 => (none)
Source RPM: tomcat-9.0.102-1.mga10.src.rpm, tomcat-9.0.102-1.mga9.src.rpm => tomcat-9.0.102-1.mga9.src.rpm
Version: Cauldron => 9
Whiteboard: MGA9TOO => (none)
Status: NEW => ASSIGNED

katnatek 2025-04-29 19:33:18 CEST

Keywords: (none) => advisory

Comment 2 Herman Viaene 2025-05-03 17:28:05 CEST
MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
Following bug 33863:
Added following lines to /etc/tomcat/tomcat-users.xml before the end line:
<role rolename="manager-gui"/>
<user name="tester9" password="tester" roles="manager-gui" />
sample.war file  still there from previous bug 34112.
Then at  CLI:
# systemctl start httpd
# systemctl -l status httpd
● httpd.service - The Apache HTTP Server
     Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: disabled)
     Active: active (running) since Sat 2025-05-03 17:18:09 CEST; 14s ago
   Main PID: 4922 (/usr/sbin/httpd)
     Status: "Total requests: 0; Idle/Busy workers 100/0;Requests/sec: 0; Bytes served/sec:   0 B/sec"
      Tasks: 6 (limit: 8806)
     Memory: 23.4M
        CPU: 562ms
     CGroup: /system.slice/httpd.service
             ├─4922 /usr/sbin/httpd -DFOREGROUND
             ├─4924 /usr/sbin/httpd -DFOREGROUND
             ├─4925 /usr/sbin/httpd -DFOREGROUND
             ├─4926 /usr/sbin/httpd -DFOREGROUND
             ├─4927 /usr/sbin/httpd -DFOREGROUND
             └─4928 /usr/sbin/httpd -DFOREGROUND

May 03 17:18:08 mach3.hviaene.thuis systemd[1]: Starting httpd.service...
May 03 17:18:09 mach3.hviaene.thuis systemd[1]: Started httpd.service.

# systemctl restart tomcat.service
# systemctl -l status tomcat.service
● tomcat.service - Apache Tomcat Web Application Container
     Loaded: loaded (/usr/lib/systemd/system/tomcat.service; disabled; preset: disabled)
     Active: active (running) since Sat 2025-05-03 17:18:44 CEST; 14s ago
   Main PID: 4993 (java)
      Tasks: 23 (limit: 8806)
     Memory: 138.9M
        CPU: 18.049s
     CGroup: /system.slice/tomcat.service
             └─4993 /usr/lib/jvm/jre/bin/java -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -classpath /usr/share/tomcat/bin>

May 03 17:18:49 mach3.hviaene.thuis server[4993]: 03-May-2025 17:18:49.666 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line ar>
May 03 17:18:49 mach3.hviaene.thuis server[4993]: 03-May-2025 17:18:49.684 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent Loaded A>
May 03 17:18:49 mach3.hviaene.thuis server[4993]: 03-May-2025 17:18:49.687 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent APR capa>
May 03 17:18:49 mach3.hviaene.thuis server[4993]: 03-May-2025 17:18:49.688 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent APR/Open>
May 03 17:18:49 mach3.hviaene.thuis server[4993]: 03-May-2025 17:18:49.711 INFO [main] org.apache.catalina.core.AprLifecycleListener.initializeSSL OpenSSL s>
May 03 17:18:52 mach3.hviaene.thuis server[4993]: 03-May-2025 17:18:52.937 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler >
May 03 17:18:53 mach3.hviaene.thuis server[4993]: 03-May-2025 17:18:53.336 INFO [main] org.apache.catalina.startup.Catalina.load Server initialization in [6>
May 03 17:18:53 mach3.hviaene.thuis server[4993]: 03-May-2025 17:18:53.825 INFO [main] org.apache.catalina.core.StandardService.startInternal Starting servi>
May 03 17:18:53 mach3.hviaene.thuis server[4993]: 03-May-2025 17:18:53.832 INFO [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servle>
May 03 17:18:54 mach3.hviaene.thuis server[4993]: 03-May-2025 17:18:54.018 INFO [main] org.apache.catalina.startup.HostConfig.deployWAR Deploying web applic>


Them I could connect to http://localhost:8080 to exercise the the manager app and http://localhost:8080/sample to display the  samples.
OK for me.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK

Comment 3 Thomas Andrews 2025-05-04 01:38:48 CEST
Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Comment 4 Mageia Robot 2025-05-05 06:58:44 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0145.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.