This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Apache Tomcat fixes 1 vulnerability
Apache fixes a vulnerability in the Tomcat product [1]. The vulnerability arose due to an insufficient fix for the vulnerability CVE-2024-50379 [2]. To fix it, it is necessary to update to version 11.0.2, 10.1.34 or 9.0.98 [1] and then adjust the configuration as follows: if you use Java 8 or 11 - set sun.io.useCanonCaches to false [3][4][5] if you use Java 17 - if you use sun.io.useCanonCaches, set it to false [4][5] if you use Java 21 - no configuration change is needed [4][5]
Allows an attacker to execute code by uploading a file and exploiting a TOCTOU flaw. The vulnerability is exploitable only on case-insensitive operating systems and with default servlets with write enabled (readonly = false) [1].
The vulnerability is present in product:
- Apache Tomcat; >=11.0.0-M1, <11.0.2; >=10.1.0-M1, <10.1.34; >=9.0.0.M1, <9.0.98;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-56337 at cve.org, NVD
- CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition at cwe.mitre.org
The vulnerability was publicly disclosed 20. 12. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 7. 1. 2025.