CVE-2024-50379

A flaw was found in Tomcat. A Time-of-check Time-of-use (TOCTOU) race condition occurs during JSP compilation on case-insensitive file systems when the default servlet is enabled for writing. This vulnerability allows an uploaded file to be treated as a JSP and executed, resulting in remote code execution.

This flaw can only be exploited when the readonly initialization parameter value is set to false, when running on case insensitive file systems and when the application is under load, specifically when read and upload operations are performed on the same file simultaneously.

The default readonly initialization parameter value is true and not vulnerable to this issue.

Due to the conditions for this issue to be exploited, especially because it requires unlikely configurations, this flaw has been rated with a Moderate severity.

The Tomcat package as shipped in Red Hat Enterprise Linux 6 and 7 is not affected by this vulnerability because the vulnerable code was introduced in a newer Tomcat version.

Red Hat Satellite is not directed impacted by this issue as it does not include the affected Tomcat package. However, Tomcat is consumed by Candlepin, a component of Satellite. Red Hat Satellite users are advised to check the impact state of Red Hat Enterprise Linux as any necessary fixes will be distributed through the platform.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Consider setting the readonly initialization parameter value to true (the default value), if that is not possible, do not use a case-insensitive file system.