Bug#1111096: tomcat10: CVE-2025-48989

[Salvatore Bonaccorso]

Source: tomcat10
Version: 10.1.40-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: clone -1 -2
Control: reassign -2 src:tomcat11 11.0.6-1
Control: retitle -2 tomcat11: CVE-2025-48989

Hi,

The following vulnerability was published for tocmat.

CVE-2025-48989[0]:
| Improper Resource Shutdown or Release vulnerability in Apache Tomcat
| made Tomcat vulnerable to the made you reset attack.  This issue
| affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1
| through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL
| versions may also be affected.  Users are recommended to upgrade to
| one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-48989
    https://www.cve.org/CVERecord?id=CVE-2025-48989
[1] https://github.com/apache/tomcat/commit/f362c8eb3b8ec5b7f312f7f5610731c0fb299a06
    https://github.com/apache/tomcat/commit/73c04a10395774bda71a0b37802cf983662ce255

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore