PT-2024-9579
CVE-2024-50379
·
تاريخ النشر
2024-03-05
·
تاريخ التحديث
2026-10-29
الوصف من
CVSS 2.0
10
حرجةالمقاييسAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions prior to 11.0.2, 10.1.34, or 9.0.98.
Description
The Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Recommendations
- Upgrade Apache Tomcat to versions 11.0.2+, 10.1.34+, or 9.0.98+ to patch CVE-2024-50379 and CVE-2024.
- Temporarily restrict write access to the default servlet if immediate update is not possible.
- Disable the “examples” web application in Apache Tomcat to protect against the vulnerability.
- Set the system property sun.io.useCanonCaches to false if using Java 8 or Java 11.
- Set the system property sun.io.useCanonCaches to false if using Java 17.
- No further configuration is required for Java 21 onwards.
- Tomcat 11.0.3, 10.1.35, and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾