DEBIAN-CVE-2024-50379

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2024-50379
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50379.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2024-50379
Upstream
Published
2024-12-17T13:15:18Z
Modified
2025-10-10T19:30:54.042756Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.

References

Affected packages

Debian:11

tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.43-2~deb11u11

Affected versions

9.*

9.0.43-1
9.0.43-2~deb11u1
9.0.43-2~deb11u2
9.0.43-2~deb11u3
9.0.43-2~deb11u4
9.0.43-2~deb11u5
9.0.43-2~deb11u6
9.0.43-2~deb11u7
9.0.43-2~deb11u8
9.0.43-2~deb11u9
9.0.43-2~deb11u10

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12

tomcat10

Package

Name
tomcat10
Purl
pkg:deb/debian/tomcat10?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.1.34-0+deb12u1

Affected versions

10.*

10.1.6-1
10.1.6-1+deb12u1
10.1.6-1+deb12u2
10.1.7-1
10.1.8-1
10.1.9-1
10.1.10-1
10.1.13-1
10.1.14-1
10.1.15-1
10.1.16-1
10.1.20-1
10.1.23-1
10.1.25-1~bpo12+1
10.1.25-1
10.1.25-2
10.1.30-1~bpo12+1
10.1.30-1
10.1.31-1
10.1.33-1~bpo12+1
10.1.33-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.70-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13

tomcat10

Package

Name
tomcat10
Purl
pkg:deb/debian/tomcat10?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.1.34-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.70-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14

tomcat10

Package

Name
tomcat10
Purl
pkg:deb/debian/tomcat10?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
10.1.34-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

tomcat9

Package

Name
tomcat9
Purl
pkg:deb/debian/tomcat9?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.0.70-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}