openSUSE-SU-2026:21490-1

Details

Description of the patch:

This update for tomcat11 fixes the following issues

Update to Tomcat 11.0.24
CVE-2026-59083: Incorrect URL decoding in RewriteValve may allow security control bypass (bsc#1271397).
CVE-2026-59084: EncryptInterceptor requirements not clearly documented (bsc#1271398).

Affected Packages(11 packages)

tomcat11

openSUSE Leap 16.0

Fixed in:

11.0.24-160000.1.1

tomcat11-admin-webapps

openSUSE Leap 16.0

Fixed in:

11.0.24-160000.1.1

tomcat11-doc

openSUSE Leap 16.0

Fixed in:

11.0.24-160000.1.1

tomcat11-docs-webapp

openSUSE Leap 16.0

Fixed in:

11.0.24-160000.1.1

tomcat11-el-6_0-api

openSUSE Leap 16.0

Fixed in:

11.0.24-160000.1.1

tomcat11-embed

openSUSE Leap 16.0

Fixed in:

11.0.24-160000.1.1

tomcat11-jsp-4_0-api

openSUSE Leap 16.0

Fixed in:

11.0.24-160000.1.1

tomcat11-jsvc

openSUSE Leap 16.0

Fixed in:

11.0.24-160000.1.1

tomcat11-lib

openSUSE Leap 16.0

Fixed in:

11.0.24-160000.1.1

tomcat11-servlet-6_1-api

openSUSE Leap 16.0

Fixed in:

11.0.24-160000.1.1

References

ADVISORY

https://bugzilla.suse.com/1271397

ADVISORY

https://bugzilla.suse.com/1271398

ADVISORY

https://www.suse.com/security/cve/CVE-2026-59083/

ADVISORY

https://www.suse.com/security/cve/CVE-2026-59084/

WEB

https://www.suse.com/support/security/rating/