CVE-2024-50379

描述

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0 through 11.0.1, from 10.1.0 through 10.1.33, from 9.0.0 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

如何修補 CVE-2024-50379

要修補 CVE-2024-50379,請將受影響套件升級到下列已修補版本。

• —升級至 9.0.98 或更新版本
• —升級至 10.1.34-0+deb12u1 或更新版本
• —升級至 9.0.43-2~deb11u11 或更新版本
• —升級至 11.0.2 或更新版本
• —升級至 11.0.2 或更新版本

CVE-2024-50379 正在被利用嗎?

中等 — EPSS 為 43.7%,可持續追蹤但非最高優先。

受影響套件(5)

• >= 9.0.0, < 9.0.98, >= 10.0.0, < 10.1.34, >= 11.0.0, < 11.0.2
• from 0, < 10.1.34-0+deb12u1
• from 0, < 9.0.43-2~deb11u11
• >= 11.0.0-M1, < 11.0.2
• >= 11.0.0-M1, < 11.0.2

CVSS 分數

參考連結(18)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-50379
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2024-50379
• PATCHgithub.com/apache/tomcat
• WEBwww.openwall.com/lists/oss-security/2024/12/17/4
• WEB