Bug 2373018 (CVE-2025-49125)

Summary: CVE-2025-49125 tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: aschwart, asoldano, bbaranow, bmaxwell, boliveir, brian.stansberry, cdewolf, chfoley, cmiranda, csutherl, darran.lofthouse, dhanak, dkreling, dosoudil, drosa, dsoumis, fjuma, gmalinko, ibek, istudens, ivassile, iweiss, janstey, jclere, jrokos, jscholz, kverlaen, lgao, mnovotny, mosmerov, mposolda, msochure, msvehla, nbhumkar, nwallace, pcongius, pdelbell, pesilva, pjindal, plodge, pmackay, rmartinc, rmaucher, rstancel, rstepani, sausingh, sdawley, smaestri, ssilvert, sthorger, swoodman, szappis, tom.jenkinson, vchlup, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2373043, 2373042    
Bug Blocks:    

Description OSIDB Bzimport 2025-06-16 15:01:35 UTC
Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Comment 3 errata-xmlrpc 2025-07-28 13:52:08 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 5.8 on RHEL 7
  Red Hat JBoss Web Server 5.8 on RHEL 8
  Red Hat JBoss Web Server 5.8 on RHEL 9

Via RHSA-2025:11695 https://access.redhat.com/errata/RHSA-2025:11695

Comment 4 errata-xmlrpc 2025-07-28 13:56:48 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 5.8.5

Via RHSA-2025:11696 https://access.redhat.com/errata/RHSA-2025:11696

Comment 5 errata-xmlrpc 2025-07-30 15:49:41 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 6.1 on RHEL 10
  Red Hat JBoss Web Server 6.1 on RHEL 8
  Red Hat JBoss Web Server 6.1 on RHEL 9

Via RHSA-2025:11741 https://access.redhat.com/errata/RHSA-2025:11741

Comment 6 errata-xmlrpc 2025-07-30 15:55:43 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 6.1.1

Via RHSA-2025:11742 https://access.redhat.com/errata/RHSA-2025:11742

Comment 8 errata-xmlrpc 2025-08-20 15:31:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:14178 https://access.redhat.com/errata/RHSA-2025:14178

Comment 9 errata-xmlrpc 2025-08-20 15:31:51 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:14179 https://access.redhat.com/errata/RHSA-2025:14179

Comment 10 errata-xmlrpc 2025-08-20 15:34:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:14182 https://access.redhat.com/errata/RHSA-2025:14182

Comment 11 errata-xmlrpc 2025-08-20 15:34:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:14177 https://access.redhat.com/errata/RHSA-2025:14177

Comment 12 errata-xmlrpc 2025-08-20 15:37:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:14181 https://access.redhat.com/errata/RHSA-2025:14181

Comment 13 errata-xmlrpc 2025-08-20 15:38:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:14183 https://access.redhat.com/errata/RHSA-2025:14183

Comment 14 errata-xmlrpc 2025-08-20 15:41:18 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:14180 https://access.redhat.com/errata/RHSA-2025:14180