SUSE update for tomcat10
| Risk | Critical |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2024-56337 CVE-2025-24813 |
| CWE-ID | CWE-264 CWE-20 |
| Exploitation vector | Network |
| Public exploit | Vulnerability #2 is being exploited in the wild. |
| Vulnerable software |
SUSE Linux Enterprise High Performance Computing LTSS 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing ESPOS 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 SP5 Operating systems & Components / Operating system Web and Scripting Module Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system tomcat10-webapps Operating systems & Components / Operating system package or component tomcat10-doc Operating systems & Components / Operating system package or component tomcat10 Operating systems & Components / Operating system package or component tomcat10-docs-webapp Operating systems & Components / Operating system package or component tomcat10-embed Operating systems & Components / Operating system package or component tomcat10-lib Operating systems & Components / Operating system package or component tomcat10-servlet-6_0-api Operating systems & Components / Operating system package or component tomcat10-jsvc Operating systems & Components / Operating system package or component tomcat10-jsp-3_1-api Operating systems & Components / Operating system package or component tomcat10-admin-webapps Operating systems & Components / Operating system package or component tomcat10-el-5_0-api Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Permissions, privileges, and access controls
EUVDB-ID: #VU101893
Risk: High
CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2024-56337
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The mitigation bypass depends on the version of Java used on the system.
Update the affected package tomcat10 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Performance Computing LTSS 15: SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP5
SUSE Linux Enterprise Server 15 SP5: LTSS
Web and Scripting Module: 15-SP6
openSUSE Leap: 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP5 - SP6
SUSE Linux Enterprise Server 15: SP5 - SP6
SUSE Linux Enterprise High Performance Computing 15: SP5
tomcat10-webapps: before 10.1.39-150200.5.36.1
tomcat10-doc: before 10.1.39-150200.5.36.1
tomcat10: before 10.1.39-150200.5.36.1
tomcat10-docs-webapp: before 10.1.39-150200.5.36.1
tomcat10-embed: before 10.1.39-150200.5.36.1
tomcat10-lib: before 10.1.39-150200.5.36.1
tomcat10-servlet-6_0-api: before 10.1.39-150200.5.36.1
tomcat10-jsvc: before 10.1.39-150200.5.36.1
tomcat10-jsp-3_1-api: before 10.1.39-150200.5.36.1
tomcat10-admin-webapps: before 10.1.39-150200.5.36.1
tomcat10-el-5_0-api: before 10.1.39-150200.5.36.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:web_and_scripting_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:tomcat10-webapps:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-doc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-docs-webapp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-embed:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-lib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-servlet-6_0-api:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-jsvc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-jsp-3_1-api:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-admin-webapps:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-el-5_0-api:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20251024-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU105485
Risk: Critical
CVSSv4.0: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]
CVE-ID: CVE-2025-24813
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input when handling file uploads via HTTP PUT requests. A remote attacker can send a specially crafted HTTP PUT request to the server and gain access to sensitive information or even execute arbitrary code.
If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- a target URL for security sensitive uploads that is a sub-directory of a target URL for public uploads
- attacker knowledge of the names of security sensitive files being uploaded
- the security sensitive files also being uploaded via partial PUT
If all of the following were true, a malicious user was able to perform remote code execution:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- application was using Tomcat's file based session persistence with the default storage location
- application included a library that may be leveraged in a deserialization attack
Update the affected package tomcat10 to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Performance Computing LTSS 15: SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP5
SUSE Linux Enterprise Server 15 SP5: LTSS
Web and Scripting Module: 15-SP6
openSUSE Leap: 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP5 - SP6
SUSE Linux Enterprise Server 15: SP5 - SP6
SUSE Linux Enterprise High Performance Computing 15: SP5
tomcat10-webapps: before 10.1.39-150200.5.36.1
tomcat10-doc: before 10.1.39-150200.5.36.1
tomcat10: before 10.1.39-150200.5.36.1
tomcat10-docs-webapp: before 10.1.39-150200.5.36.1
tomcat10-embed: before 10.1.39-150200.5.36.1
tomcat10-lib: before 10.1.39-150200.5.36.1
tomcat10-servlet-6_0-api: before 10.1.39-150200.5.36.1
tomcat10-jsvc: before 10.1.39-150200.5.36.1
tomcat10-jsp-3_1-api: before 10.1.39-150200.5.36.1
tomcat10-admin-webapps: before 10.1.39-150200.5.36.1
tomcat10-el-5_0-api: before 10.1.39-150200.5.36.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:web_and_scripting_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:tomcat10-webapps:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-doc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-docs-webapp:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-embed:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-lib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-servlet-6_0-api:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-jsvc:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-jsp-3_1-api:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-admin-webapps:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:tomcat10-el-5_0-api:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20251024-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
