Bug 2332817 (CVE-2024-50379) - CVE-2024-50379 tomcat: RCE due to TOCTOU issue in JSP compilation
Summary: CVE-2024-50379 tomcat: RCE due to TOCTOU issue in JSP compilation
Keywords:
Status: NEW
Alias: CVE-2024-50379
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2333019 2333020
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-12-17 13:01 UTC by OSIDB Bzimport
Modified: 2025-04-08 12:23 UTC (History)
14 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:0342 0 None None None 2025-01-21 13:14:30 UTC
Red Hat Product Errata RHSA-2025:0343 0 None None None 2025-01-21 13:19:11 UTC
Red Hat Product Errata RHSA-2025:0361 0 None None None 2025-01-16 19:32:17 UTC
Red Hat Product Errata RHSA-2025:0362 0 None None None 2025-01-16 19:35:13 UTC
Red Hat Product Errata RHSA-2025:1920 0 None None None 2025-02-27 11:17:40 UTC
Red Hat Product Errata RHSA-2025:3645 0 None None None 2025-04-07 17:33:35 UTC
Red Hat Product Errata RHSA-2025:3646 0 None None None 2025-04-07 17:33:43 UTC
Red Hat Product Errata RHSA-2025:3647 0 None None None 2025-04-07 17:34:09 UTC
Red Hat Product Errata RHSA-2025:3683 0 None None None 2025-04-08 11:59:42 UTC
Red Hat Product Errata RHSA-2025:3684 0 None None None 2025-04-08 12:23:00 UTC

Description OSIDB Bzimport 2024-12-17 13:01:17 UTC 
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.

Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Comment 6 errata-xmlrpc 2025-01-16 19:32:15 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 5.8 on RHEL 7
  Red Hat JBoss Web Server 5.8 on RHEL 8
  Red Hat JBoss Web Server 5.8 on RHEL 9

Via RHSA-2025:0361 https://access.redhat.com/errata/RHSA-2025:0361
Comment 7 errata-xmlrpc 2025-01-16 19:35:11 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2025:0362 https://access.redhat.com/errata/RHSA-2025:0362
Comment 8 errata-xmlrpc 2025-01-21 13:14:28 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server 6.0 on RHEL 8
  Red Hat JBoss Web Server 6.0 on RHEL 9

Via RHSA-2025:0342 https://access.redhat.com/errata/RHSA-2025:0342
Comment 9 errata-xmlrpc 2025-01-21 13:19:09 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Web Server

Via RHSA-2025:0343 https://access.redhat.com/errata/RHSA-2025:0343
Comment 10 errata-xmlrpc 2025-02-27 11:17:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2025:1920 https://access.redhat.com/errata/RHSA-2025:1920
Comment 11 errata-xmlrpc 2025-04-07 17:33:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:3645 https://access.redhat.com/errata/RHSA-2025:3645
Comment 12 errata-xmlrpc 2025-04-07 17:33:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2025:3646 https://access.redhat.com/errata/RHSA-2025:3646
Comment 13 errata-xmlrpc 2025-04-07 17:34:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:3647 https://access.redhat.com/errata/RHSA-2025:3647
Comment 14 errata-xmlrpc 2025-04-08 11:59:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:3683 https://access.redhat.com/errata/RHSA-2025:3683
Comment 15 errata-xmlrpc 2025-04-08 12:22:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2025:3684 https://access.redhat.com/errata/RHSA-2025:3684
Note You need to log in before you can comment on or make changes to this bug.