Oracle Linux: CVE-2025-24813: ELSA-2025-3645: tomcat security update (MODERATE) (Multiple Advisories)

Description

A flaw was found in Apache Tomcat. In certain conditions/configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and/or add malicious content via a write-enabled Default Servlet in Apache Tomcat. For the vulnerability to be exploited, the following conditions must be true: writes to the default servlet are enabled (disabled by default), sensitive file uploads are sub-directories of a target URL for public uploads, attackers know the names of the files, and those files are subject to partial PUT uploads (enabled by default). If an application uses file-based session persistence with default storage and includes exploitable libraries, remote code execution (RCE) is possible.