Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
68776043 by Salvatore Bonaccorso at 2025-06-20T21:56:09+02:00
Add Debian bug references for tomcat issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2305,8 +2305,8 @@ CVE-2025-4565 (Any project that uses Protobuf Pure-Python
backendto parse untrus
[bullseye] - protobuf <postponed> (Minor issue; can be fixed in next
update)
NOTE:
https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901
CVE-2025-49125 (Authentication Bypass Using an Alternate Path or Channel
vulnerability ...)
- - tomcat11 <unfixed>
- - tomcat10 <unfixed>
+ - tomcat11 <unfixed> (bug #1108114)
+ - tomcat10 <unfixed> (bug #1108115)
- tomcat9 9.0.70-2
NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server
stack, using that as the fixed version
NOTE: https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk
@@ -2319,8 +2319,8 @@ CVE-2025-49124 (Untrusted Search Path vulnerability in
Apache Tomcat installer f
- tomcat9 <not-affected> (Windows-specific)
NOTE: https://lists.apache.org/thread/lnow7tt2j6hb9kcpkggx32ht6o90vqzv
CVE-2025-48988 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
- - tomcat11 <unfixed>
- - tomcat10 <unfixed>
+ - tomcat11 <unfixed> (bug #1108116)
+ - tomcat10 <unfixed> (bug #1108117)
- tomcat9 9.0.70-2
NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server
stack, using that as the fixed version
NOTE: https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18
@@ -2328,9 +2328,9 @@ CVE-2025-48988 (Allocation of Resources Without Limits or
Throttling vulnerabili
NOTE:
https://github.com/apache/tomcat/commit/cdde8e655bc1c5c60a07efd216251d77c52fd7f6
(10.1.42)
NOTE:
https://github.com/apache/tomcat/commit/ee8042ffce4cb9324dfd79efda5984f37bbb6910
(9.0.106)
CVE-2025-48976 (Allocation of resources for multipart headers with
insufficient limits ...)
- - libcommons-fileupload-java <unfixed>
- - tomcat11 <unfixed>
- - tomcat10 <unfixed>
+ - libcommons-fileupload-java <unfixed> (bug #1108120)
+ - tomcat11 <unfixed> (bug #1108118)
+ - tomcat10 <unfixed> (bug #1108119)
- tomcat9 9.0.70-2
NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server
stack, using that as the fixed version
NOTE: https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/68776043801dc22e67b0e043ac9593c164765dd3
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/68776043801dc22e67b0e043ac9593c164765dd3
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
