Bug 2332817 (CVE-2024-50379)

Summary:	CVE-2024-50379 tomcat: RCE due to TOCTOU issue in JSP compilation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aganbat, csutherl, cwarfiel, gsuckevi, jclere, kyoshida, mhhall3, michael.h.hall-1, pjindal, plodge, rgatica, rmaucher, szappis, vrajput
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Tomcat. A Time-of-check Time-of-use (TOCTOU) race condition occurs during JSP compilation on case-insensitive file systems when the default servlet is enabled for writing. This vulnerability allows an uploaded file to be treated as a JSP and executed, resulting in remote code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2333019, 2333020
Bug Blocks:

Description OSIDB Bzimport 2024-12-17 13:01:17 UTC

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.

Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

Comment 6 errata-xmlrpc 2025-01-16 19:32:15 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 5.8 on RHEL 7
  Red Hat JBoss Web Server 5.8 on RHEL 8
  Red Hat JBoss Web Server 5.8 on RHEL 9

Via RHSA-2025:0361 https://access.redhat.com/errata/RHSA-2025:0361

Comment 7 errata-xmlrpc 2025-01-16 19:35:11 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2025:0362 https://access.redhat.com/errata/RHSA-2025:0362

Comment 8 errata-xmlrpc 2025-01-21 13:14:28 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 6.0 on RHEL 8
  Red Hat JBoss Web Server 6.0 on RHEL 9

Via RHSA-2025:0342 https://access.redhat.com/errata/RHSA-2025:0342

Comment 9 errata-xmlrpc 2025-01-21 13:19:09 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2025:0343 https://access.redhat.com/errata/RHSA-2025:0343

Comment 10 errata-xmlrpc 2025-02-27 11:17:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2025:1920 https://access.redhat.com/errata/RHSA-2025:1920

Comment 11 errata-xmlrpc 2025-04-07 17:33:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:3645 https://access.redhat.com/errata/RHSA-2025:3645

Comment 12 errata-xmlrpc 2025-04-07 17:33:41 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2025:3646 https://access.redhat.com/errata/RHSA-2025:3646

Comment 13 errata-xmlrpc 2025-04-07 17:34:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:3647 https://access.redhat.com/errata/RHSA-2025:3647

Comment 14 errata-xmlrpc 2025-04-08 11:59:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:3683 https://access.redhat.com/errata/RHSA-2025:3683

Comment 15 errata-xmlrpc 2025-04-08 12:22:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2025:3684 https://access.redhat.com/errata/RHSA-2025:3684