CVE-2024-50379
Apache Tomcat: remote code execution via TOCTOU race during JSP compilation
Technology
Apache Tomcat
CVSS Score
9.8 / 10.0
Affected Versions
11.0.0-M1 to 11.0.1; 10.1.0-M1 to 10.1.33; 9.0.0.M1 to 9.0.97; end of life but known affected: 8.5.0 to 8.5.100
Upstream Fix
11.0.2; 10.1.34; 9.0.98
Published
December 17, 2024
OSSeva Coverage
Fixed upstream
Description
A time-of-check time-of-use race during JSP compilation permits remote code execution on case-insensitive file systems when the default servlet is enabled for write, which is not the default. Fixed in 11.0.2, 10.1.34 and 9.0.98. The mitigation was incomplete; see CVE-2024-56337.
Is your Apache Tomcat deployment affected?
If you're running 11.0.0-M1 to 11.0.1; 10.1.0-M1 to 10.1.33; 9.0.0.M1 to 9.0.97; end of life but known affected: 8.5.0 to 8.5.100, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat 11.0.0-M1 to 11.0.1; 10.1.0-M1 to 10.1.33; 9.0.0.M1 to 9.0.97; end of life but known affected: 8.5.0 to 8.5.100?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?