CVE-2024-56337

The fix for CVE-2024-50379 in Apache Tomcat was insufficient to mitigate the issue fully. A Time-of-check Time-of-use (TOCTOU) race condition occurs during JSP compilation on case-insensitive file systems when the default servlet is enabled for writing. This vulnerability allows an uploaded file to be treated as a JSP and executed, resulting in remote code execution.

The vulnerability is marked as moderate rather than important due to the specific conditions required for exploitation. For the attack to succeed, the server must be running on a case-insensitive file system (e.g., Windows or macOS) and have the default servlet enabled with write permissions —a configuration that is not common in production-grade environments. Additionally, the attacker must gain the ability to upload files to a writable directory and exploit a race condition to execute them as JSP files, which introduces a level of complexity and timing dependency.

The pki-servlet-engine package has been obsoleted by the tomcat package as of Red Hat Enterprise Linux 8.9 so no fixes for the servlet engine would be made available.

Although Red Hat Satellite Server— via its Candlepin component— employs the use of Tomcat, Satellite is itself not considered Affected. Satellite does not provide the Tomcat package— it is inherited from the underlying RHEL Operating System. Users of Red Hat Satellite are advised to refer to the impact state of the Tomcat package provided by the version of RHEL underpinning the Satellite Server instance, as any errata will be provided via RHEL Application Stream repositories.

It should be noted that a successful attack requires the server be running on a case-insensitive file system. As Satellite only runs on RHEL— and RHEL employs case-sensitive filesystems by default— a typical Satellite server instance is not vulnerable. Additionally, a successful attack also requires the server have the default servlet enabled with write permissions– a condition which does not exist in a default Satellite deployment. Again, a typical Satellite server instance is not vulnerable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.