Bug#1111098: tomcat10: CVE-2025-55668

[Salvatore Bonaccorso]

Source: tomcat10
Version: 10.1.40-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: clone -1 -2
Control: reassign -2 src:tomcat11 11.0.6-1
Control: retitle -2 tomcat11: CVE-2025-5566

Hi,

The following vulnerability was published for tocmat.

CVE-2025-55668[0]:
| Session Fixation vulnerability in Apache Tomcat via rewrite valve.
| This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7,
| from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.
| Older, EOL versions may also be affected.  Users are recommended to
| upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-55668
    https://www.cve.org/CVERecord?id=CVE-2025-55668
[2] https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore