[CLSA-2026:1794394593] tomcat: Fix of CVE-2026-65182
Type:
security
Severity:
Important
Release date:
2026-11-11 10:56:45 UTC
Description:
- Rebase onto AL2 7.0.76-10.amzn2.0.20 - Fix CVE-2026-101296 - Retain the TuxCare ELS patches: canonical-path containment checks with the FileUtil helper and its File.separator follow-up; the LockOutRealm and RealmBase credential-handling and security-constraint matching fixes; constant-time comparison in AbstractAjpProcessor and DigestAuthenticator via ConstantTime; and the bounded request-body read in WebdavServlet - Renumber the TuxCare patches to Patch1034-Patch1041 so they follow the vendor's new Patch1033
CVEs fixed:
Updated packages:
  • tomcat-7.0.76-10.amzn2.0.20.tuxcare.els1.noarch.rpm
    sha:c20a508484826a95420c953bc160d9f13b844d1ce01292fbbd34da9908a41322
  • tomcat-admin-webapps-7.0.76-10.amzn2.0.20.tuxcare.els1.noarch.rpm
    sha:fcf9de4fecb49955953cb956ac0a1596d576ba571d1d915c9961448b6e298c8b
  • tomcat-docs-webapp-7.0.76-10.amzn2.0.20.tuxcare.els1.noarch.rpm
    sha:425334aa350dcb5f046352b52f749f49c38ca25f40dfc850a4f89f23dbec6ebe
  • tomcat-el-2.2-api-7.0.76-10.amzn2.0.20.tuxcare.els1.noarch.rpm
    sha:6711603870b3f0847eb3490dd94d601343e231edff258807effd163151346875
  • tomcat-javadoc-7.0.76-10.amzn2.0.20.tuxcare.els1.noarch.rpm
    sha:c87be7bf451b13c07fc26cf9ad79ccf0c867682f3873b9e16b9fb132fdf8c6fb
  • tomcat-jsp-2.2-api-7.0.76-10.amzn2.0.20.tuxcare.els1.noarch.rpm
    sha:d4f1f3bb121bef13dc8461efe45f5ed02b58f4d17c5b1f11ee17c5b64a4aad60
  • tomcat-jsvc-7.0.76-10.amzn2.0.20.tuxcare.els1.noarch.rpm
    sha:6e3fc7955ba8ed49c2274ee6863bed6b53c568849611510c6ab3a5d72cb28452
  • tomcat-lib-7.0.76-10.amzn2.0.20.tuxcare.els1.noarch.rpm
    sha:12fa5d95d184ff23306792a667de50bedebb1afc6f91f7edf5c4fe7d7f9d86eb
  • tomcat-servlet-3.0-api-7.0.76-10.amzn2.0.20.tuxcare.els1.noarch.rpm
    sha:dbeab6bb122f5f3f25667446fe7a972de37ebc8dad120bea1658dcda8470b193
  • tomcat-webapps-7.0.76-10.amzn2.0.20.tuxcare.els1.noarch.rpm
    sha:1da16f6bd033a2bb90ab6c775712ce070f5011d80c201212d4993f09bee93534
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.