CVE-2024-50379
Vulnerability Summary
Timeline
Description
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
CVSS Metrics
- v4.0•CRITICAL•Score: 9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
- v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Trends
Current EPSS score: 44.31%• Percentile: 99%
Techniques & Countermeasures
- CWE-367•Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Affected Systems
- apache software foundation•apache tomcat
≥ 11.0.0-M1, ≤ 11.0.1 | ≥ 10.1.0-M1, ≤ 10.1.33 | ≥ 9.0.0.M1, ≤ 9.0.97 | ≥ 8.5.0, ≤ 8.5.100
- apache•tomcat
≥ 9.0.0, < 9.0.98 | ≥ 10.1.0, < 10.1.34 | ≥ 11.0.0, < 11.0.2
- chainguard•thingsboard
< 3.9-r1
- chainguard•thingsboard-tb-js-executor
< 3.9-r1
- chainguard•thingsboard-tb-mqtt-transport
< 3.9-r1
- chainguard•thingsboard-tb-node
< 3.9-r1
- chainguard•thingsboard-tb-web-ui
< 3.9-r1
- wolfi•thingsboard
< 3.9-r1
- wolfi•thingsboard-tb-js-executor
< 3.9-r1
- wolfi•thingsboard-tb-mqtt-transport
< 3.9-r1
- wolfi•thingsboard-tb-node
< 3.9-r1
- wolfi•thingsboard-tb-web-ui
< 3.9-r1
- debian•tomcat10
< 10.1.34-0+deb12u1 | < 10.1.34-1 | < 10.1.34-1
- debian•tomcat9
< 9.0.43-2~deb11u11 | < 9.0.70-2 | < 9.0.70-2 | < 9.0.70-2
- ubuntu•tomcat10
< 10.1.16-1ubuntu0.1~esm3
- ubuntu•tomcat9
all | all | all | all
- org.apache.tomcat•tomcat-catalina
≥ 11.0.0-M1, < 11.0.2 | ≥ 10.1.0-M1, < 10.1.34 | ≥ 9.0.0.M1, < 9.0.98 | ≥ 8.5.0, ≤ 8.5.100
- org.apache.tomcat.embed•tomcat-embed-core
≥ 11.0.0-M1, < 11.0.2 | ≥ 10.1.0-M1, < 10.1.34 | ≥ 9.0.0.M1, < 9.0.98 | ≥ 8.5.0, ≤ 8.5.100
- netapp•bootstrap_os
na
- redhat•jws5-tomcat
< 0:9.0.87-6.redhat_00006.1.el7jws | < 0:9.0.87-6.redhat_00006.1.el8jws | < 0:9.0.87-6.redhat_00006.1.el9jws
- redhat•jws5-tomcat-admin-webapps
< 0:9.0.87-6.redhat_00006.1.el7jws | < 0:9.0.87-6.redhat_00006.1.el8jws | < 0:9.0.87-6.redhat_00006.1.el9jws
- redhat•jws5-tomcat-docs-webapp
< 0:9.0.87-6.redhat_00006.1.el7jws | < 0:9.0.87-6.redhat_00006.1.el8jws | < 0:9.0.87-6.redhat_00006.1.el9jws
- redhat•jws5-tomcat-el-3.0-api
< 0:9.0.87-6.redhat_00006.1.el7jws | < 0:9.0.87-6.redhat_00006.1.el8jws | < 0:9.0.87-6.redhat_00006.1.el9jws
- redhat•jws5-tomcat-java-jdk11
< 0:9.0.87-6.redhat_00006.1.el7jws
- redhat•jws5-tomcat-java-jdk8
< 0:9.0.87-6.redhat_00006.1.el7jws
- redhat•jws5-tomcat-javadoc
< 0:9.0.87-6.redhat_00006.1.el7jws | < 0:9.0.87-6.redhat_00006.1.el8jws | < 0:9.0.87-6.redhat_00006.1.el9jws
- redhat•jws5-tomcat-jsp-2.3-api
< 0:9.0.87-6.redhat_00006.1.el7jws | < 0:9.0.87-6.redhat_00006.1.el8jws | < 0:9.0.87-6.redhat_00006.1.el9jws
- redhat•jws5-tomcat-lib
< 0:9.0.87-6.redhat_00006.1.el7jws | < 0:9.0.87-6.redhat_00006.1.el8jws | < 0:9.0.87-6.redhat_00006.1.el9jws
- redhat•jws5-tomcat-selinux
< 0:9.0.87-6.redhat_00006.1.el7jws | < 0:9.0.87-6.redhat_00006.1.el8jws | < 0:9.0.87-6.redhat_00006.1.el9jws
- redhat•jws5-tomcat-servlet-4.0-api
< 0:9.0.87-6.redhat_00006.1.el7jws | < 0:9.0.87-6.redhat_00006.1.el8jws | < 0:9.0.87-6.redhat_00006.1.el9jws
- redhat•jws5-tomcat-webapps
< 0:9.0.87-6.redhat_00006.1.el7jws | < 0:9.0.87-6.redhat_00006.1.el8jws | < 0:9.0.87-6.redhat_00006.1.el9jws
- redhat•jws6-tomcat
< 0:10.1.8-15.redhat_00022.1.el8jws | < 0:10.1.8-15.redhat_00022.1.el9jws
- redhat•jws6-tomcat-admin-webapps
< 0:10.1.8-15.redhat_00022.1.el8jws | < 0:10.1.8-15.redhat_00022.1.el9jws
- redhat•jws6-tomcat-docs-webapp
< 0:10.1.8-15.redhat_00022.1.el8jws | < 0:10.1.8-15.redhat_00022.1.el9jws
- redhat•jws6-tomcat-el-5.0-api
< 0:10.1.8-15.redhat_00022.1.el8jws | < 0:10.1.8-15.redhat_00022.1.el9jws
- redhat•jws6-tomcat-javadoc
< 0:10.1.8-15.redhat_00022.1.el8jws | < 0:10.1.8-15.redhat_00022.1.el9jws
- redhat•jws6-tomcat-jsp-3.1-api
< 0:10.1.8-15.redhat_00022.1.el8jws | < 0:10.1.8-15.redhat_00022.1.el9jws
- redhat•jws6-tomcat-lib
< 0:10.1.8-15.redhat_00022.1.el8jws | < 0:10.1.8-15.redhat_00022.1.el9jws
- redhat•jws6-tomcat-selinux
< 0:10.1.8-15.redhat_00022.1.el8jws | < 0:10.1.8-15.redhat_00022.1.el9jws
- redhat•jws6-tomcat-servlet-6.0-api
< 0:10.1.8-15.redhat_00022.1.el8jws | < 0:10.1.8-15.redhat_00022.1.el9jws
- redhat•jws6-tomcat-webapps
< 0:10.1.8-15.redhat_00022.1.el8jws | < 0:10.1.8-15.redhat_00022.1.el9jws
- redhat•pki-servlet-4.0-api
< 1:9.0.50-1.el9_2.2
- redhat•pki-servlet-engine
< 1:9.0.50-1.el9_2.2
References (33)
- https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r
- http://www.openwall.com/lists/oss-security/2024/12/17/4
- http://www.openwall.com/lists/oss-security/2024/12/18/2
- https://security.netapp.com/advisory/ntap-20250103-0003/
- https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-50379
- https://github.com/apache/tomcat/commit/05ddeeaa54df1e2dc427d0164bedd6b79f78d81f
- https://github.com/apache/tomcat/commit/43b507ebac9d268b1ea3d908e296cc6e46795c00
- https://github.com/apache/tomcat/commit/631500b0c9b2a2a2abb707e3de2e10a5936e5d41
- https://github.com/apache/tomcat/commit/684247ae85fa633b9197b32391de59fc54703842
- https://github.com/apache/tomcat/commit/8554f6b1722b33a2ce8b0a3fad37825f3a75f2d2
- https://github.com/apache/tomcat/commit/cc7a98b57c6dc1df21979fcff94a36e068f4456c
- https://github.com/apache/tomcat
- https://security.netapp.com/advisory/ntap-20250103-0003
- https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.34
- https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.2
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.98
- https://access.redhat.com/errata/RHSA-2025:0342
- https://access.redhat.com/security/updates/classification/#moderate
- https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.0/html-single/red_hat_jboss_web_server_6.0_service_pack_5_release_notes/index
- https://bugzilla.redhat.com/show_bug.cgi?id=2332817
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0342.json
- https://access.redhat.com/security/cve/CVE-2024-50379
- https://www.cve.org/CVERecord?id=CVE-2024-50379
- https://access.redhat.com/errata/RHSA-2025:0361
- https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html-single/red_hat_jboss_web_server_5.8_service_pack_2_release_notes/index
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0361.json
- https://access.redhat.com/errata/RHSA-2025:1920
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1920.json
- https://ubuntu.com/security/CVE-2024-50379
- https://ubuntu.com/security/notices/USN-7705-1
- https://security-tracker.debian.org/tracker/CVE-2024-50379
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50379.json