CVE-2024-56337

{"id": "CVE-2024-56337", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-12-20T16:15:24.260", "references": [{"url": "https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2024-50379", "tags": ["Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://security.netapp.com/advisory/ntap-20250103-0002/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nThe mitigation for CVE-2024-50379 was incomplete.\n\nUsers running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation \nparameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:\n- running on Java 8 or Java 11: the system property\u00a0sun.io.useCanonCaches must be explicitly set to false (it defaults to true)\n- running on Java 17: the\u00a0system property sun.io.useCanonCaches, if set, must be set to false\u00a0(it defaults to false)\n- running on Java 21 onwards: no further configuration is required\u00a0(the system property and the problematic cache have been removed)\n\nTomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that\u00a0sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set\u00a0sun.io.useCanonCaches to false by default where it can."}, {"lang": "es", "value": "Vulnerabilidad de condici\u00f3n de ejecuci\u00f3n de tiempo de uso y tiempo de verificaci\u00f3n (TOCTOU) en Apache Tomcat. Este problema afecta a Apache Tomcat: desde 11.0.0-M1 hasta 11.0.1, desde 10.1.0-M1 hasta 10.1.33, desde 9.0.0.M1 hasta 9.0.97. La mitigaci\u00f3n de CVE-2024-50379 fue incompleta. Los usuarios que ejecuten Tomcat en un sistema de archivos que no distinga entre may\u00fasculas y min\u00fasculas con la escritura del servlet predeterminada habilitada (el par\u00e1metro de inicializaci\u00f3n de solo lectura establecido en el valor no predeterminado de falso) pueden necesitar una configuraci\u00f3n adicional para mitigar por completo CVE-2024-50379 seg\u00fan la versi\u00f3n de Java que est\u00e9n usando con Tomcat: - ejecut\u00e1ndose en Java 8 o Java 11: la propiedad del sistema sun.io.useCanonCaches debe establecerse expl\u00edcitamente en falso (el valor predeterminado es verdadero) - ejecut\u00e1ndose en Java 17: la propiedad del sistema sun.io.useCanonCaches, si est\u00e1 establecida, debe establecerse en falso (el valor predeterminado es falso) - ejecut\u00e1ndose en Java 21 en adelante: no se requiere ninguna configuraci\u00f3n adicional (la propiedad del sistema y el cach\u00e9 problem\u00e1tico se han eliminado) Tomcat 11.0.3, 10.1.35 y 9.0.99 en adelante incluir\u00e1n comprobaciones de que sun.io.useCanonCaches est\u00e9 configurado correctamente antes de permitir que el servlet predeterminado est\u00e9 habilitado para escritura en un sistema de archivos que no distinga entre may\u00fasculas y min\u00fasculas. Tomcat tambi\u00e9n establecer\u00e1 sun.io.useCanonCaches como falso de forma predeterminada cuando sea posible."}], "lastModified": "2025-08-08T12:15:27.340", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A10E3B7-32E3-40A9-9633-CAA2F1E2EFA3", "versionEndExcluding": "9.0.98", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "499AC261-223E-483B-81AF-AFD6BEA35502", "versionEndExcluding": "10.1.34", "versionStartIncluding": "10.1.0"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC54C74D-E851-4A9A-9C49-B8C80D5502AE", "versionEndExcluding": "11.0.2", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95BA156C-C977-4F0C-8DFB-3FAE9CC8C02D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AD7447BC-F315-4298-A822-549942FC118B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@apache.org"}