Those CVEs were announced here: https://www.openwall.com/lists/oss-security/2025/06/16/1 https://www.openwall.com/lists/oss-security/2025/06/16/2
Status comment: (none) => Fixed upstream in 9.0.106CVE: (none) => CVE-2025-48988, CVE-2025-49125Source RPM: (none) => tomcat-9.0.105-1.mga10.src.rpm, tomcat-9.0.105-1.mga9.src.rpmWhiteboard: (none) => MGA9TOO
Assigning to our registered tomcat maintainer, CC'ing daviddavid, who pushed tomcat a lot of times.
CC: (none) => geiger.david68210, marja11Assignee: bugsquad => mageia
Suggested advisory: ======================== The updated packages fix security vulnerabilities: FileUpload large number of parts with headers DoS. (CVE-2025-48988) Security constraint bypass for pre/post-resources. (CVE-2025-49125) References: https://www.openwall.com/lists/oss-security/2025/06/16/1 https://www.openwall.com/lists/oss-security/2025/06/16/2 ======================== Updated packages in core/updates_testing: ======================== tomcat-9.0.106-1.mga9 tomcat-admin-webapps-9.0.106-1.mga9 tomcat-docs-webapp-9.0.106-1.mga9 tomcat-el-3.0-api-9.0.106-1.mga9 tomcat-jsp-2.3-api-9.0.106-1.mga9 tomcat-lib-9.0.106-1.mga9 tomcat-servlet-4.0-api-9.0.106-1.mga9 tomcat-webapps-9.0.106-1.mga9 from SRPM: tomcat-9.0.106-1.mga9.src.rpm
Source RPM: tomcat-9.0.105-1.mga10.src.rpm, tomcat-9.0.105-1.mga9.src.rpm => tomcat-9.0.105-1.mga9.src.rpmAssignee: mageia => qa-bugsStatus comment: Fixed upstream in 9.0.106 => (none)Status: NEW => ASSIGNEDWhiteboard: MGA9TOO => (none)Version: Cauldron => 9
Keywords: (none) => advisory
MGA9-64 server Plasma Wayland on Compaq H000SB No installation issues. Ref bug 34332 for testing: # systemctl start httpd [root@mach3 ~]# systemctl -l status httpd ● httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; preset: disabled) Active: active (running) since Tue 2025-06-24 11:06:06 CEST; 14s ago Main PID: 52742 (/usr/sbin/httpd) Status: "Total requests: 0; Idle/Busy workers 100/0;Requests/sec: 0; Bytes served/sec: 0 B/sec" Tasks: 6 (limit: 8806) Memory: 43.0M CPU: 1.260s CGroup: /system.slice/httpd.service ├─52742 /usr/sbin/httpd -DFOREGROUND ├─52748 /usr/sbin/httpd -DFOREGROUND ├─52749 /usr/sbin/httpd -DFOREGROUND ├─52750 /usr/sbin/httpd -DFOREGROUND ├─52751 /usr/sbin/httpd -DFOREGROUND └─52752 /usr/sbin/httpd -DFOREGROUND Jun 24 11:06:06 mach3.hviaene.thuis systemd[1]: Starting httpd.service... Jun 24 11:06:06 mach3.hviaene.thuis systemd[1]: Started httpd.service. [root@mach3 ~]# systemctl restart tomcat.service [root@mach3 ~]# systemctl -l status tomcat.service ● tomcat.service - Apache Tomcat Web Application Container Loaded: loaded (/usr/lib/systemd/system/tomcat.service; disabled; preset: disabled) Active: active (running) since Tue 2025-06-24 11:06:47 CEST; 29s ago Main PID: 52875 (java) Tasks: 37 (limit: 8806) Memory: 197.5M CPU: 33.168s CGroup: /system.slice/tomcat.service └─52875 /usr/lib/jvm/jre/bin/java -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -classpath /usr/share/tomcat/bi> Jun 24 11:07:09 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:09.416 INFO [main] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was s> Jun 24 11:07:09 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:09.455 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of> Jun 24 11:07:09 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:09.460 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web> Jun 24 11:07:10 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:10.931 INFO [main] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was s> Jun 24 11:07:10 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:10.953 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of> Jun 24 11:07:10 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:10.966 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web> Jun 24 11:07:12 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:12.888 INFO [main] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was s> Jun 24 11:07:12 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:12.910 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of> Jun 24 11:07:12 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:12.965 INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["> Jun 24 11:07:13 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:13.121 INFO [main] org.apache.catalina.startup.Catalina.start Server startup in [14565]> Then I could connect to http://localhost:8080 to exercise the the manager app and display the samples. Good to go.
Whiteboard: (none) => MGA9-64-OKCC: (none) => herman.viaene
(In reply to Herman Viaene from comment #3) > MGA9-64 server Plasma Wayland on Compaq H000SB > No installation issues. > Ref bug 34332 for testing: > # systemctl start httpd > [root@mach3 ~]# systemctl -l status httpd > ● httpd.service - The Apache HTTP Server > Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; > preset: disabled) > Active: active (running) since Tue 2025-06-24 11:06:06 CEST; 14s ago > Main PID: 52742 (/usr/sbin/httpd) > Status: "Total requests: 0; Idle/Busy workers 100/0;Requests/sec: 0; > Bytes served/sec: 0 B/sec" > Tasks: 6 (limit: 8806) > Memory: 43.0M > CPU: 1.260s > CGroup: /system.slice/httpd.service > ├─52742 /usr/sbin/httpd -DFOREGROUND > ├─52748 /usr/sbin/httpd -DFOREGROUND > ├─52749 /usr/sbin/httpd -DFOREGROUND > ├─52750 /usr/sbin/httpd -DFOREGROUND > ├─52751 /usr/sbin/httpd -DFOREGROUND > └─52752 /usr/sbin/httpd -DFOREGROUND > > Jun 24 11:06:06 mach3.hviaene.thuis systemd[1]: Starting httpd.service... > Jun 24 11:06:06 mach3.hviaene.thuis systemd[1]: Started httpd.service. > [root@mach3 ~]# systemctl restart tomcat.service > [root@mach3 ~]# systemctl -l status tomcat.service > ● tomcat.service - Apache Tomcat Web Application Container > Loaded: loaded (/usr/lib/systemd/system/tomcat.service; disabled; > preset: disabled) > Active: active (running) since Tue 2025-06-24 11:06:47 CEST; 29s ago > Main PID: 52875 (java) > Tasks: 37 (limit: 8806) > Memory: 197.5M > CPU: 33.168s > CGroup: /system.slice/tomcat.service > └─52875 /usr/lib/jvm/jre/bin/java > -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp. > BasicDataSourceFactory -classpath /usr/share/tomcat/bi> > > Jun 24 11:07:09 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:09.416 > INFO [main] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR > was s> > Jun 24 11:07:09 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:09.455 > INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory > Deployment of> > Jun 24 11:07:09 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:09.460 > INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying > web> > Jun 24 11:07:10 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:10.931 > INFO [main] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR > was s> > Jun 24 11:07:10 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:10.953 > INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory > Deployment of> > Jun 24 11:07:10 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:10.966 > INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying > web> > Jun 24 11:07:12 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:12.888 > INFO [main] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR > was s> > Jun 24 11:07:12 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:12.910 > INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory > Deployment of> > Jun 24 11:07:12 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:12.965 > INFO [main] org.apache.coyote.AbstractProtocol.start Starting > ProtocolHandler ["> > Jun 24 11:07:13 mach3.hviaene.thuis server[52875]: 24-Jun-2025 11:07:13.121 > INFO [main] org.apache.catalina.startup.Catalina.start Server startup in > [14565]> > > > Then I could connect to http://localhost:8080 to exercise the the manager app > and display the samples. > Good to go. Thank you for your test
CC: (none) => andrewsfarm
Validating.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2025-0191.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED