CVE-2024-50379
CRITICAL9.8EPSS 84.8%Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
發布日:2024/12/17修改日:2026/2/4
描述
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
受影響套件(5)
- Bitnami/tomcat>= 9.0.0, < 9.0.98, >= 10.0.0, < 10.1.34, >= 11.0.0, < 11.0.2
- Debian/tomcat10from 0, < 10.1.34-0+deb12u1
- Debian/tomcat9from 0, < 9.0.43-2~deb11u11
- Maven/org.apache.tomcat.embed:tomcat-embed-core>= 11.0.0-M1, < 11.0.2
- Maven/org.apache.tomcat:tomcat-catalina>= 11.0.0-M1, < 11.0.2
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U |
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
參考連結(18)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-50379
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2024-50379
- PATCHhttps://github.com/apache/tomcat
- WEBhttps://github.com/apache/tomcat/commit/05ddeeaa54df1e2dc427d0164bedd6b79f78d81f
- WEBhttps://github.com/apache/tomcat/commit/43b507ebac9d268b1ea3d908e296cc6e46795c00
- WEBhttps://github.com/apache/tomcat/commit/631500b0c9b2a2a2abb707e3de2e10a5936e5d41
- WEBhttps://github.com/apache/tomcat/commit/684247ae85fa633b9197b32391de59fc54703842
- WEBhttps://github.com/apache/tomcat/commit/8554f6b1722b33a2ce8b0a3fad37825f3a75f2d2
- WEBhttps://github.com/apache/tomcat/commit/cc7a98b57c6dc1df21979fcff94a36e068f4456c
- WEBhttps://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r
- WEBhttps://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
- WEBhttps://security.netapp.com/advisory/ntap-20250103-0003
- WEBhttps://security.netapp.com/advisory/ntap-20250103-0003/
- WEBhttps://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.34
- WEBhttps://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.2
- WEBhttps://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.98
- WEBhttp://www.openwall.com/lists/oss-security/2024/12/17/4
- WEBhttp://www.openwall.com/lists/oss-security/2024/12/18/2