[El-errata] ELSA-2025-7497 Moderate: Oracle Linux 10 tomcat security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2025-7497

http://linux.oracle.com/errata/ELSA-2025-7497.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
tomcat-10.1.36-1.el10_0.noarch.rpm
tomcat-admin-webapps-10.1.36-1.el10_0.noarch.rpm
tomcat-docs-webapp-10.1.36-1.el10_0.noarch.rpm
tomcat-el-5.0-api-10.1.36-1.el10_0.noarch.rpm
tomcat-jsp-3.1-api-10.1.36-1.el10_0.noarch.rpm
tomcat-lib-10.1.36-1.el10_0.noarch.rpm
tomcat-servlet-6.0-api-10.1.36-1.el10_0.noarch.rpm
tomcat-webapps-10.1.36-1.el10_0.noarch.rpm

aarch64:
tomcat-10.1.36-1.el10_0.noarch.rpm
tomcat-admin-webapps-10.1.36-1.el10_0.noarch.rpm
tomcat-docs-webapp-10.1.36-1.el10_0.noarch.rpm
tomcat-el-5.0-api-10.1.36-1.el10_0.noarch.rpm
tomcat-jsp-3.1-api-10.1.36-1.el10_0.noarch.rpm
tomcat-lib-10.1.36-1.el10_0.noarch.rpm
tomcat-servlet-6.0-api-10.1.36-1.el10_0.noarch.rpm
tomcat-webapps-10.1.36-1.el10_0.noarch.rpm


SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/tomcat-10.1.36-1.el10_0.src.rpm

Related CVEs:

CVE-2024-52316
CVE-2024-54677
CVE-2025-24813




Description of changes:

[1:10.1.36-1]
- Rebase tomcat to 10.1.36
- Resolves: RHEL-82925
  tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
- Resolves: RHEL-87272
  tomcat: DoS in examples web application (CVE-2024-54677)
- Resolves: RHEL-87273
  tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)
- Resolves: RHEL-85343 - NoClassDefFoundError when using migration tool