Suggested advisory:
========================

The updated packages fix a security vulnerability:

Security constraint bypass for CGI scripts. (CVE-2025-46701)

References:
https://openwall.com/lists/oss-security/2025/05/29/4
========================

Updated packages in core/updates_testing:
========================
tomcat-9.0.105-1.mga9
tomcat-admin-webapps-9.0.105-1.mga9
tomcat-docs-webapp-9.0.105-1.mga9
tomcat-el-3.0-api-9.0.105-1.mga9
tomcat-jsp-2.3-api-9.0.105-1.mga9
tomcat-lib-9.0.105-1.mga9
tomcat-servlet-4.0-api-9.0.105-1.mga9
tomcat-webapps-9.0.105-1.mga9

from SRPM:
tomcat-9.0.105-1.mga9.src.rpm

Assignee: bugsquad => qa-bugs
Source RPM: tomcat-9.0.104-1.mga10.src.rpm, tomcat-9.0.104-1.mga9.src.rpm => tomcat-9.0.104-1.mga9.src.rpm
Status: NEW => ASSIGNED
Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9
Status comment: Fixed upstream in 9.0.105 => (none)

MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues overwriting current version.
Ref bug 34231 for testing
# systemctl start httpd
# systemctl -l status httpd
● httpd.service - The Apache HTTP Server
     Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: disabled)
     Active: active (running) since Thu 2025-06-05 11:28:46 CEST; 12s ago
   Main PID: 28831 (/usr/sbin/httpd)
     Status: "Total requests: 0; Idle/Busy workers 100/0;Requests/sec: 0; Bytes served/sec:   0 B/sec"
      Tasks: 6 (limit: 8806)
     Memory: 29.1M
        CPU: 780ms
     CGroup: /system.slice/httpd.service
             ├─28831 /usr/sbin/httpd -DFOREGROUND
             ├─28834 /usr/sbin/httpd -DFOREGROUND
             ├─28835 /usr/sbin/httpd -DFOREGROUND
             ├─28836 /usr/sbin/httpd -DFOREGROUND
             ├─28837 /usr/sbin/httpd -DFOREGROUND
             └─28838 /usr/sbin/httpd -DFOREGROUND

Jun 05 11:28:46 mach3.hviaene.thuis systemd[1]: Starting httpd.service...
Jun 05 11:28:46 mach3.hviaene.thuis systemd[1]: Started httpd.service.

# systemctl restart tomcat.service
# systemctl -l status tomcat.service
● tomcat.service - Apache Tomcat Web Application Container
     Loaded: loaded (/usr/lib/systemd/system/tomcat.service; disabled; preset: disabled)
     Active: active (running) since Thu 2025-06-05 11:29:20 CEST; 16s ago
   Main PID: 28918 (java)
      Tasks: 23 (limit: 8806)
     Memory: 130.2M
        CPU: 20.437s
     CGroup: /system.slice/tomcat.service
             └─28918 /usr/lib/jvm/jre/bin/java -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -classpath /usr/share/tomcat/bi>

Jun 05 11:29:27 mach3.hviaene.thuis server[28918]: 05-Jun-2025 11:29:27.299 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line a>
Jun 05 11:29:27 mach3.hviaene.thuis server[28918]: 05-Jun-2025 11:29:27.335 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent Loaded >
Jun 05 11:29:27 mach3.hviaene.thuis server[28918]: 05-Jun-2025 11:29:27.339 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent APR cap>
Jun 05 11:29:27 mach3.hviaene.thuis server[28918]: 05-Jun-2025 11:29:27.341 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent APR/Ope>
Jun 05 11:29:27 mach3.hviaene.thuis server[28918]: 05-Jun-2025 11:29:27.376 INFO [main] org.apache.catalina.core.AprLifecycleListener.initializeSSL OpenSSL >
Jun 05 11:29:31 mach3.hviaene.thuis server[28918]: 05-Jun-2025 11:29:31.533 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler>
Jun 05 11:29:32 mach3.hviaene.thuis server[28918]: 05-Jun-2025 11:29:32.068 INFO [main] org.apache.catalina.startup.Catalina.load Server initialization in [>
Jun 05 11:29:32 mach3.hviaene.thuis server[28918]: 05-Jun-2025 11:29:32.850 INFO [main] org.apache.catalina.core.StandardService.startInternal Starting serv>
Jun 05 11:29:32 mach3.hviaene.thuis server[28918]: 05-Jun-2025 11:29:32.865 INFO [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servl>
Jun 05 11:29:33 mach3.hviaene.thuis server[28918]: 05-Jun-2025 11:29:33.015 INFO [main] org.apache.catalina.startup.HostConfig.deployWAR Deploying web appli>


Then I could connect to http://localhost:8080 to exercise the the manager app and http://localhost:8080/sample to display the  samples.
OK for me.

Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene

Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0177.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED