Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The mitigation for CVE-2024-50379 was incomplete.
Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:
Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.
The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Tomcat | Apache | 9.0.0 (including) | 9.0.98 (excluding) |
Tomcat | Apache | 10.1.0 (including) | 10.1.34 (excluding) |
Tomcat | Apache | 11.0.0 (including) | 11.0.2 (excluding) |
Red Hat Enterprise Linux 10 | RedHat | tomcat9-1:9.0.87-5.el10_0.1 | * |
Red Hat Enterprise Linux 8 | RedHat | tomcat-1:9.0.87-1.el8_10.4 | * |
Red Hat Enterprise Linux 8.8 Telecommunications Update Service | RedHat | tomcat-1:9.0.87-1.el8_8.5 | * |
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | RedHat | tomcat-1:9.0.87-1.el8_8.5 | * |
Red Hat Enterprise Linux 9 | RedHat | tomcat-1:9.0.87-3.el9_6.1 | * |
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | RedHat | tomcat-1:9.0.87-1.el9_2.4 | * |
Red Hat Enterprise Linux 9.4 Extended Update Support | RedHat | tomcat-1:9.0.87-1.el9_4.4 | * |
Red Hat JBoss Web Server 5 | RedHat | tomcat | * |
Red Hat JBoss Web Server 5.8 on RHEL 7 | RedHat | jws5-tomcat-0:9.0.87-11.redhat_00010.1.el7jws | * |
Red Hat JBoss Web Server 5.8 on RHEL 8 | RedHat | jws5-tomcat-0:9.0.87-11.redhat_00010.1.el8jws | * |
Red Hat JBoss Web Server 5.8 on RHEL 9 | RedHat | jws5-tomcat-0:9.0.87-11.redhat_00010.1.el9jws | * |
Tomcat10 | Ubuntu | esm-apps/noble | * |
Tomcat10 | Ubuntu | noble | * |
Tomcat10 | Ubuntu | oracular | * |
Tomcat10 | Ubuntu | upstream | * |
Tomcat9 | Ubuntu | focal | * |
Tomcat9 | Ubuntu | oracular | * |