PT-2024-9579
CVE-2024-50379
·
Published
2024-03-05
·
Updated
2026-10-29
Description by
CVSS 2.0
10
CriticalMetricsAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions prior to 11.0.2, 10.1.34, or 9.0.98.
Description
The Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Recommendations
- Upgrade Apache Tomcat to versions 11.0.2+, 10.1.34+, or 9.0.98+ to patch CVE-2024-50379 and CVE-2024.
- Temporarily restrict write access to the default servlet if immediate update is not possible.
- Disable the “examples” web application in Apache Tomcat to protect against the vulnerability.
- Set the system property sun.io.useCanonCaches to false if using Java 8 or Java 11.
- Set the system property sun.io.useCanonCaches to false if using Java 17.
- No further configuration is required for Java 21 onwards.
- Tomcat 11.0.3, 10.1.35, and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾