CVE-2024-56337
Apache Tomcat: incomplete mitigation for CVE-2024-50379
Technology
Apache Tomcat
CVSS Score
9.8 / 10.0
Affected Versions
11.0.0-M1 to 11.0.1; 10.1.0-M1 to 10.1.33; 9.0.0.M1 to 9.0.97; end of life but known affected: 8.5.0 to 8.5.100
Upstream Fix
11.0.2; 10.1.34; 9.0.98, plus JVM configuration
Published
December 20, 2024
OSSeva Coverage
Fixed upstream
Description
The mitigation for CVE-2024-50379 was incomplete. On a case-insensitive file system with the default servlet write-enabled, users also need the JVM setting sun.io.useCanonCaches=false on Java 8 or 11, and on Java 17 the property must be false if set; Java 21 and later need nothing extra. From 11.0.3, 10.1.35 and 9.0.99, Tomcat checks the setting before allowing the default servlet to be write-enabled.
Is your Apache Tomcat deployment affected?
If you're running 11.0.0-M1 to 11.0.1; 10.1.0-M1 to 10.1.33; 9.0.0.M1 to 9.0.97; end of life but known affected: 8.5.0 to 8.5.100, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat 11.0.0-M1 to 11.0.1; 10.1.0-M1 to 10.1.33; 9.0.0.M1 to 9.0.97; end of life but known affected: 8.5.0 to 8.5.100?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?