Release date:
2026-09-04 09:40:47 UTC
Description:
- CVE-2026-73180: track the WebSocket sessions of an authenticated HTTP session by a key
held in a session attribute rather than the live session id, so they are still closed
when the HTTP session ends after its id has changed (upstream tomcat 9.0.121)
Updated packages:
-
tomcat-9.0.87-3.el9_6.3.tuxcare.els17.noarch.rpm
sha:3b87d6ad841b995b47a100ce7d17f7aa1d9bccd2fd1b7ba83f4cfa010a4c2a52
-
tomcat-admin-webapps-9.0.87-3.el9_6.3.tuxcare.els17.noarch.rpm
sha:8ab185f7c09563d08c108328229ce7f3839ab93ad66f6d46f3e6a3724c26580d
-
tomcat-docs-webapp-9.0.87-3.el9_6.3.tuxcare.els17.noarch.rpm
sha:34ebb0f23086c4bdd97becebaf41582783ffec78e34a32072a1f6341e28568d6
-
tomcat-el-3.0-api-9.0.87-3.el9_6.3.tuxcare.els17.noarch.rpm
sha:aca54c6d8fd97240c318d5f72cfb726a7c7442e39df54f87fabd9488c774f8de
-
tomcat-jsp-2.3-api-9.0.87-3.el9_6.3.tuxcare.els17.noarch.rpm
sha:b3ace93f8767d0f652b3f60c4c6e6935cdd01c959302ba64e4a1246a704bcfc9
-
tomcat-lib-9.0.87-3.el9_6.3.tuxcare.els17.noarch.rpm
sha:ed0ed1c0c5a8d66e8588f947abde1da3f97e78cfa0b37f012ce7b64aa580ec0c
-
tomcat-servlet-4.0-api-9.0.87-3.el9_6.3.tuxcare.els17.noarch.rpm
sha:b65052af0663fab4e4b52ad53de6c04499039ade915d8b95d35cea62d912b00a
-
tomcat-webapps-9.0.87-3.el9_6.3.tuxcare.els17.noarch.rpm
sha:1a387d161606764b4c19929146dd5ff12fac8c616f141e555e2ac168a4271b48
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
