BSD PortsApache Tomcat -- RCE due to TOCTOU issue in JSP compilation
· CVE-2024-56337 · VuXML entry
[email protected] reports: Time-of-check Time-of-use (TOCTOU) Race Condition The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with …
Affected versions
- tomcat110 > 11.0.0 < 11.0.1
- tomcat101 > 10.1.0 < 10.1.33
- tomcat9 > 9.0.0 < 9.0.97
By system
0 still vulnerable, 6 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | www/tomcat110 | 11.0.8 | fixed | |
| MidnightBSD | www/tomcat110 | 11.0.27 | out of range, by version | |
| FreeBSD | www/tomcat110 | 11.0.27 | fixed | (556 days after) |
| DragonFly | www/tomcat101 | 10.1.42 | fixed | |
| MidnightBSD | www/tomcat101 | 10.1.61 | out of range, by version | |
| FreeBSD | www/tomcat101 | 10.1.61 | fixed | (556 days after) |
| DragonFly | www/tomcat9 | 9.0.106 | fixed | |
| MidnightBSD | www/tomcat9 | 9.0.123 | out of range, by version | |
| FreeBSD | www/tomcat9 | 9.0.123 | fixed | (556 days after) |