{
  "threat_severity" : "Low",
  "public_date" : "2025-06-16T14:18:09Z",
  "bugzilla" : {
    "description" : "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources",
    "id" : "2373018",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2373018"
  },
  "cvss3" : {
    "cvss3_base_score" : "3.7",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-288",
  "details" : [ "Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.", "A flaw has been discovered in path handling logic in Apache Tomcat. When using either PreResources or PostResources mounted on a non-root path, it is possible to access resources via an unexpected path. This may result in leaking of files on those paths." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2025-08-20T00:00:00Z",
    "advisory" : "RHSA-2025:14178",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.0",
    "package" : "tomcat9-1:9.0.87-5.el10_0.3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2025-08-20T00:00:00Z",
    "advisory" : "RHSA-2025:14179",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.0",
    "package" : "tomcat-1:10.1.36-1.el10_0.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2025-08-20T00:00:00Z",
    "advisory" : "RHSA-2025:14177",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "tomcat-1:9.0.87-1.el8_10.6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2025-08-20T00:00:00Z",
    "advisory" : "RHSA-2025:14182",
    "cpe" : "cpe:/a:redhat:rhel_tus:8.8",
    "package" : "tomcat-1:9.0.87-1.el8_8.7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2025-08-20T00:00:00Z",
    "advisory" : "RHSA-2025:14182",
    "cpe" : "cpe:/a:redhat:rhel_e4s:8.8",
    "package" : "tomcat-1:9.0.87-1.el8_8.7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-08-20T00:00:00Z",
    "advisory" : "RHSA-2025:14181",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "tomcat-1:9.0.87-3.el9_6.3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2025-08-20T00:00:00Z",
    "advisory" : "RHSA-2025:14183",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "tomcat-1:9.0.87-1.el9_2.6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-08-20T00:00:00Z",
    "advisory" : "RHSA-2025:14180",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "tomcat-1:9.0.87-1.el9_4.6"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.8.5",
    "release_date" : "2025-07-28T00:00:00Z",
    "advisory" : "RHSA-2025:11696",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.8",
    "package" : "tomcat-catalina"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.8 on RHEL 7",
    "release_date" : "2025-07-28T00:00:00Z",
    "advisory" : "RHSA-2025:11695",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.8::el7",
    "package" : "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el7jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.8 on RHEL 8",
    "release_date" : "2025-07-28T00:00:00Z",
    "advisory" : "RHSA-2025:11695",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.8::el8",
    "package" : "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el8jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5.8 on RHEL 9",
    "release_date" : "2025-07-28T00:00:00Z",
    "advisory" : "RHSA-2025:11695",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5.8::el9",
    "package" : "jws5-tomcat-0:9.0.87-12.redhat_00011.1.el9jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6.1.1",
    "release_date" : "2025-07-30T00:00:00Z",
    "advisory" : "RHSA-2025:11742",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6.1",
    "package" : "tomcat-catalina"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6.1 on RHEL 10",
    "release_date" : "2025-07-30T00:00:00Z",
    "advisory" : "RHSA-2025:11741",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6.1::el10",
    "package" : "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el10jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6.1 on RHEL 8",
    "release_date" : "2025-07-30T00:00:00Z",
    "advisory" : "RHSA-2025:11741",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6.1::el8",
    "package" : "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el8jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6.1 on RHEL 9",
    "release_date" : "2025-07-30T00:00:00Z",
    "advisory" : "RHSA-2025:11741",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6.1::el9",
    "package" : "jws6-tomcat-0:10.1.36-7.redhat_00008.1.el9jws"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Data Grid 8",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat-catalina",
    "cpe" : "cpe:/a:redhat:jboss_data_grid:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "mod_proxy_cluster",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "tomcat6",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "pki-deps:10.6/pki-servlet-engine",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "log4j",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "mod_proxy_cluster",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "pki-servlet-engine",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Fuse 7",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat-catalina",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7"
  }, {
    "product_name" : "Red Hat Integration Camel K 1",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat-catalina",
    "cpe" : "cpe:/a:redhat:integration:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Fix deferred",
    "package_name" : "jbcs-httpd24-mod_cluster-native",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat JBoss Core Services",
    "fix_state" : "Fix deferred",
    "package_name" : "jbcs-httpd24-mod_proxy_cluster",
    "cpe" : "cpe:/a:redhat:jboss_core_services:1"
  }, {
    "product_name" : "Red Hat OpenShift Dev Spaces",
    "fix_state" : "Fix deferred",
    "package_name" : "devspaces/server-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3"
  }, {
    "product_name" : "Red Hat OpenShift Dev Spaces",
    "fix_state" : "Fix deferred",
    "package_name" : "devspaces/server-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3"
  }, {
    "product_name" : "Red Hat Process Automation 7",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat-catalina",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
  }, {
    "product_name" : "Red Hat Single Sign-On 7",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat-catalina",
    "cpe" : "cpe:/a:redhat:red_hat_single_sign_on:7"
  }, {
    "product_name" : "streams for Apache Kafka",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat-catalina",
    "cpe" : "cpe:/a:redhat:amq_streams:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-49125\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-49125\nhttps://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk" ],
  "name" : "CVE-2025-49125",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}