Vulnerability · Published Dec 17, 2024 · Assigned by apache
CVE-2024-50379Apache Tomcat: RCE due to TOCTOU issue in JSP compilation
Critical 9.8
In plain English
A critical-severity security flaw in Apache Tomcat from Apache Software Foundation. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 31.8% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | tomcat | 1:9.0.87-1.el8_10.4 | ALSA-2025:11333 |
| AlmaLinux:8 | tomcat | 1:9.0.87-1.el8_10.3 | ALSA-2025:3683 |
| AlmaLinux:9 | tomcat | 1:9.0.87-2.el9_5.1 | ALSA-2025:3645 |
| AlmaLinux:9 | tomcat | 1:9.0.87-3.el9_6.1 | ALSA-2025:11335 |
| AlmaLinux:8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.4 | ALSA-2025:11333 |
| AlmaLinux:8 | tomcat-admin-webapps | 1:9.0.87-1.el8_10.3 | ALSA-2025:3683 |
| AlmaLinux:9 | tomcat-admin-webapps | 1:9.0.87-3.el9_6.1 | ALSA-2025:11335 |
| AlmaLinux:9 | tomcat-admin-webapps | 1:9.0.87-2.el9_5.1 | ALSA-2025:3645 |
| AlmaLinux:8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.4 | ALSA-2025:11333 |
| AlmaLinux:8 | tomcat-docs-webapp | 1:9.0.87-1.el8_10.3 | ALSA-2025:3683 |
| AlmaLinux:9 | tomcat-docs-webapp | 1:9.0.87-2.el9_5.1 | ALSA-2025:3645 |
| AlmaLinux:9 | tomcat-docs-webapp | 1:9.0.87-3.el9_6.1 | ALSA-2025:11335 |
| AlmaLinux:8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.3 | ALSA-2025:3683 |
| AlmaLinux:8 | tomcat-el-3.0-api | 1:9.0.87-1.el8_10.4 | ALSA-2025:11333 |
| AlmaLinux:9 | tomcat-el-3.0-api | 1:9.0.87-2.el9_5.1 | ALSA-2025:3645 |
| AlmaLinux:9 | tomcat-el-3.0-api | 1:9.0.87-3.el9_6.1 | ALSA-2025:11335 |
| AlmaLinux:8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.3 | ALSA-2025:3683 |
| AlmaLinux:8 | tomcat-jsp-2.3-api | 1:9.0.87-1.el8_10.4 | ALSA-2025:11333 |
| AlmaLinux:9 | tomcat-jsp-2.3-api | 1:9.0.87-2.el9_5.1 | ALSA-2025:3645 |
| AlmaLinux:9 | tomcat-jsp-2.3-api | 1:9.0.87-3.el9_6.1 | ALSA-2025:11335 |
| AlmaLinux:8 | tomcat-lib | 1:9.0.87-1.el8_10.4 | ALSA-2025:11333 |
| AlmaLinux:8 | tomcat-lib | 1:9.0.87-1.el8_10.3 | ALSA-2025:3683 |
| AlmaLinux:9 | tomcat-lib | 1:9.0.87-2.el9_5.1 | ALSA-2025:3645 |
| AlmaLinux:9 | tomcat-lib | 1:9.0.87-3.el9_6.1 | ALSA-2025:11335 |
| AlmaLinux:8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.4 | ALSA-2025:11333 |
| AlmaLinux:8 | tomcat-servlet-4.0-api | 1:9.0.87-1.el8_10.3 | ALSA-2025:3683 |
| AlmaLinux:9 | tomcat-servlet-4.0-api | 1:9.0.87-3.el9_6.1 | ALSA-2025:11335 |
| AlmaLinux:9 | tomcat-servlet-4.0-api | 1:9.0.87-2.el9_5.1 | ALSA-2025:3645 |
| AlmaLinux:8 | tomcat-webapps | 1:9.0.87-1.el8_10.4 | ALSA-2025:11333 |
| AlmaLinux:8 | tomcat-webapps | 1:9.0.87-1.el8_10.3 | ALSA-2025:3683 |
| AlmaLinux:9 | tomcat-webapps | 1:9.0.87-3.el9_6.1 | ALSA-2025:11335 |
| AlmaLinux:9 | tomcat-webapps | 1:9.0.87-2.el9_5.1 | ALSA-2025:3645 |
| AlmaLinux:10 | tomcat9 | 1:9.0.87-5.el10_0.1 | ALSA-2025:11332 |
| AlmaLinux:10 | tomcat9-admin-webapps | 1:9.0.87-5.el10_0.1 | ALSA-2025:11332 |
| AlmaLinux:10 | tomcat9-docs-webapp | 1:9.0.87-5.el10_0.1 | ALSA-2025:11332 |
| AlmaLinux:10 | tomcat9-el-3.0-api | 1:9.0.87-5.el10_0.1 | ALSA-2025:11332 |
| AlmaLinux:10 | tomcat9-jsp-2.3-api | 1:9.0.87-5.el10_0.1 | ALSA-2025:11332 |
| AlmaLinux:10 | tomcat9-lib | 1:9.0.87-5.el10_0.1 | ALSA-2025:11332 |
| AlmaLinux:10 | tomcat9-servlet-4.0-api | 1:9.0.87-5.el10_0.1 | ALSA-2025:11332 |
| AlmaLinux:10 | tomcat9-webapps | 1:9.0.87-5.el10_0.1 | ALSA-2025:11332 |
| Debian:12 | tomcat10 | 10.1.34-0+deb12u1 | DEBIAN-CVE-2024-50379 |
| Debian:12 | tomcat10 | 10.1.34-0+deb12u1 | DSA-5845-1 |
| Debian:13 | tomcat10 | 10.1.34-1 | DEBIAN-CVE-2024-50379 |
| Debian:14 | tomcat10 | 10.1.34-1 | DEBIAN-CVE-2024-50379 |
| Debian:12 | tomcat9 | 9.0.70-2 | DEBIAN-CVE-2024-50379 |
| Debian:13 | tomcat9 | 9.0.70-2 | DEBIAN-CVE-2024-50379 |
| Debian:14 | tomcat9 | 9.0.70-2 | DEBIAN-CVE-2024-50379 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.1.34 | GHSA-5j33-cvvr-w245 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 11.0.2 | GHSA-5j33-cvvr-w245 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.98 | GHSA-5j33-cvvr-w245 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | no fix listed | GHSA-5j33-cvvr-w245 |
| Maven | org.apache.tomcat:tomcat-catalina | no fix listed | GHSA-5j33-cvvr-w245 |
| Maven | org.apache.tomcat:tomcat-catalina | 9.0.98 | GHSA-5j33-cvvr-w245 |
| Maven | org.apache.tomcat:tomcat-catalina | 10.1.34 | GHSA-5j33-cvvr-w245 |
| Maven | org.apache.tomcat:tomcat-catalina | 11.0.2 | GHSA-5j33-cvvr-w245 |
| Rocky Linux:8 | tomcat | 1:9.0.87-1.el8_10.3 | RLSA-2025:3683 |
| Rocky Linux:9 | tomcat | 1:9.0.87-2.el9_5.1 | RLSA-2025:3645 |
| Ubuntu:24.04:LTS | tomcat9 | no fix listed | UBUNTU-CVE-2024-50379 |
| Ubuntu:25.10 | tomcat9 | no fix listed | UBUNTU-CVE-2024-50379 |
| Ubuntu:26.04:LTS | tomcat9 | no fix listed | UBUNTU-CVE-2024-50379 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Tomcat | 11.0.0-M1 – through 11.0.110.1.0-M1 – through 10.1.339.0.0.M1 – through 9.0.978.5.0 – through 8.5.100 |
Weakness: CWE-367 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r vendor-advisory
- http://www.openwall.com/lists/oss-security/2024/12/17/4
- http://www.openwall.com/lists/oss-security/2024/12/18/2
- https://security.netapp.com/advisory/ntap-20250103-0003/
- https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html