Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4521 advisory.

    Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web     applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster),     the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.

    This release of Red Hat JBoss Web Server 5.8.4 serves as a replacement for Red Hat JBoss Web Server 5.8.3.
    This release includes bug fixes, enhancements and component upgrades, which are documented in the Release     Notes that are linked to in the References section.

    Security Fix(es):

    * tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation [jws-5]     (CVE-2024-56337)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1126-1 advisory.

    - CVE-2025-24813: Fixed potential RCE and/or information disclosure/corruption with partial PUT     (bsc#1239302)

    - Update to Tomcat 9.0.102
      * Fixes:
        - launch with java 17 (bsc#1239676)
      * Catalina
        - Fix: Weak etags in the If-Range header should not match as strong etags           are required. (remm)
        - Fix: When looking up class loader resources by resource name, the resource           name should not start with '/'. If the resource name does start with '/',           Tomcat is lenient and looks it up as if the '/' was not present. When the           web application class loader was configured with external repositories and           names starting with '/' were used for lookups, it was possible that cached           'not found' results could effectively hide lookup results using the           correct resource name. (markt)
        - Fix: Enable the JNDIRealm to validate credentials provided to           HttpServletRequest.login(String username, String password) when the realm           is configured to use GSSAPI authentication. (markt)
        - Fix: Fix a bug in the JRE compatibility detection that incorrectly           identified Java 19 and Java 20 as supporting Java 21 features. (markt)
        - Fix: Improve the checks for exposure to and protection against           CVE-2024-56337 so that reflection is not used unless required. The checks           for whether the file system is case sensitive or not have been removed.
          (markt)
        - Fix: Avoid scenarios where temporary files used for partial PUT would not           be deleted. (remm)
        - Fix: 69602: Fix regression in releases from 12-2024 that were too strict           and rejected weak etags in the If-Range header. (remm)
        - Fix: 69576: Avoid possible failure initializing JreCompat due to uncaught           exception introduced for the check for CVE-2024-56337. (remm)
      * Cluster
        - Add: 69598: Add detection of service account token changes to the           KubernetesMembershipProvider implementation and reload the token if it           changes. Based on a patch by Miroslav Jezbera. (markt)
      * Coyote
        - Fix: 69575: Avoid using compression if a response is already compressed           using compress, deflate or zstd. (remm)
        - Update: Use Transfer-Encoding for compression rather than Content-Encoding           if the client submits a TE header containing gzip. (remm)
        - Fix: Fix a race condition in the handling of HTTP/2 stream reset that           could cause unexpected 500 responses. (markt)
      * Other
        - Add: Add makensis as an option for building the Installer for Windows on           non-Windows platforms. (rjung/markt)
        - Update: Update Byte Buddy to 1.17.1. (markt)
        - Update: Update Checkstyle to 10.21.3. (markt)
        - Update: Update SpotBugs to 4.9.1. (markt)
        - Update: Update JSign to 7.1. (markt)
        - Add: Improvements to French translations. (remm)
        - Add: Improvements to Japanese translations by tak7iji. (markt)
        - Add: Add org.apache.juli.JsonFormatter to format log as one line JSON           documents. (remm)

    - Update to Tomcat 9.0.99
      * Catalina
        - Update: Add tableName configuration on the DataSourcePropertyStore that           may be used by the WebDAV Servlet. (remm)
        - Update: Improve HTTP If headers processing according to RFC 9110. Based on           pull request #796 by Chenjp. (remm/markt)
        - Update: Allow readOnly attribute configuration on the Resources element           and allow configure the readOnly attribute value of the main resources.
          The attribute value will also be used by the default and WebDAV Servlets.
          (remm)         + Fix: 69285: Optimise the creation of the parameter map for included           requests. Based on sample code and test cases provided by John           Engebretson. (markt)         + Fix: 69527: Avoid rare cases where a cached resource could be set with 0           content length, or could be evicted immediately. (remm)         + Fix: Fix possible edge cases (such as HTTP/1.0) with trying to detect           requests without body for WebDAV LOCK and PROPFIND. (remm)         + Fix: 69528: Add multi-release JAR support for the bloom           archiveIndexStrategy of the Resources. (remm)         + Fix: Improve checks for WEB-INF and META-INF in the WebDAV servlet. Based           on a patch submitted by Chenjp. (remm)         + Add: Add a check to ensure that, if one or more web applications are           potentially vulnerable to CVE-2024-56337, the JVM has been configured to           protect against the vulnerability and to configure the JVM correctly if           not. Where one or more web applications are potentially vulnerable to           CVE-2024-56337 and the JVM cannot be correctly configured or it cannot be           confirmed that the JVM has been correctly configured, prevent the impacted           web applications from starting. (markt)         + Fix: Remove unused session to client map from CrawlerSessionManagerValve.
          Submitted by Brian Matzon. (remm)         + Fix: When using the WebDAV servlet with serveSubpathOnly set to true,           ensure that the destination for any requested WebDAV operation is also           restricted to the sub-path. (markt)         + Fix: Generate an appropriate Allow HTTP header when the Default servlet           returns a 405 (method not allowed) response in response to a DELETE           request because the target resource cannot be deleted. Pull request #802           provided by Chenjp. (markt)         + Code: Refactor creation of RequestDispatcher instances so that the           processing of the provided path is consistent with normal request           processing. (markt)         + Add: Add encodedReverseSolidusHandling and encodedSolidusHandling           attributes to Context to provide control over the handling of the path           used to created a RequestDispatcher. (markt)         + Fix: Handle a potential NullPointerException after an IOException occurs           on a non-container thread during asynchronous processing. (markt)         + Fix: Enhance lifecycle of temporary files used by partial PUT. (remm)
      * Coyote         + Fix: Don't log warnings for registered HTTP/2 settings that Tomcat does           not support. These settings are now silently ignored. (markt)         + Fix: Avoid a rare NullPointerException when recycling the           Http11InputBuffer. (markt)         + Fix: Lower the log level to debug for logging an invalid socket channel           when processing poller events for the NIO Connector as this may occur in           normal usage. (markt)         + Code: Clean-up references to the HTTP/2 stream once request processing has           completed to aid GC and reduce the size of the HTTP/2 recycled request and           response cache. (markt)         + Add: Add a new Connector configuration attribute,           encodedReverseSolidusHandling, to control how %5c sequences in URLs are           handled. The default behaviour is unchanged (decode) keeping in mind that           the allowBackslash attribute determines how the decoded URI is processed.
          (markt)         + Fix: 69545: Improve CRLF skipping for the available method of the           ChunkedInputFilter. (remm)         + Fix: Improve the performance of repeated calls to getHeader(). Pull           request #813 provided by Adwait Kumar Singh. (markt)         + Fix: 69559: Ensure that the Java 24 warning regarding the use of           sun.misc.Unsafe::invokeCleaner is only reported by the JRE when the code           will be used. (markt)
      * Jasper         + Fix: 69508: Correct a regression in the fix for 69382 that broke JSP           include actions if both the page attribute and the body contained           parameters. Pull request #803 provided by Chenjp. (markt)         + Fix: 69521: Update the EL Parser to allow the full range of valid           characters in an EL identifier as defined by the Java Language           Specification. (markt)         + Fix: 69532: Optimise the creation of ExpressionFactory instances. Patch           provided by John Engebretson. (markt)
      * Web applications         + Add: Documentation. Expand the description of the security implications of           setting mapperContextRootRedirectEnabled and/or           mapperDirectoryRedirectEnabled to true. (markt)         + Fix: Documentation. Better document the default for the truststoreProvider           attribute of a SSLHostConfig element. (markt)
      * Other         + Update: Update to Commons Daemon 1.4.1. (markt)         + Update: Update the internal fork of Commons Pool to 2.12.1. (markt)         + Update: Update Byte Buddy to 1.16.1. (markt)         + Update: Update UnboundID to 7.0.2. (markt)         + Update: Update Checkstyle to 10.21.2. (markt)         + Update: Update SpotBugs to 4.9.0. (markt)         + Add: Improvements to French translations. (remm)         + Add: Improvements to Chinese translations by leeyazhou. (markt)         + Add: Improvements to Japanese translations by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1024-1 advisory.

    - CVE-2025-24813: Fixed potential RCE and/or information disclosure/corruption with           partial PUT (bsc#1239302)

    Other fixes:

    - Update to Tomcat 10.1.39
      * Fixes:
        - launch with java 17 (bsc#1239676)
      * Catalina
        - Fix: 69602: Fix regression in releases from 12-2024 that were too strict           and rejected weak etags in the If-Range header with a 400 response.
          Instead will consider it as a failed match since strong etags are required           for If-Range. (remm)
        - Fix: When looking up class loader resources by resource name, the resource           name should not start with '/'. If the resource name does start with '/',           Tomcat is lenient and looks it up as if the '/' was not present. When the           web application class loader was configured with external repositories and           names starting with '/' were used for lookups, it was possible that cached           'not found' results could effectively hide lookup results using the           correct resource name. (markt)
        - Fix: Enable the JNDIRealm to validate credentials provided to           HttpServletRequest.login(String username, String password) when the realm           is configured to use GSSAPI authentication. (markt)
        - Fix: Fix a bug in the JRE compatibility detection that incorrectly           identified Java 19 and Java 20 as supporting Java 21 features. (markt)
        - Fix: Improve the checks for exposure to and protection against           CVE-2024-56337 so that reflection is not used unless required. The checks           for whether the file system is case sensitive or not have been removed.
          (markt)
        - Add: Add support for logging the connection ID (as returned by           ServletRequest.getServletConnection().getConnectionId()) with the           AccessLogValve and ExtendedAccessLogValve. Based on pull request #814 by           Dmole. (markt)
        - Fix: Avoid scenarios where temporary files used for partial PUT would not           be deleted. (remm)
        - Fix: 69576: Avoid possible failure initializing JreCompat due to uncaught           exception introduced for the check for CVE-2024-56337. (remm)
      * Cluster
        - Add: 69598: Add detection of service account token changes to the           KubernetesMembershipProvider implementation and reload the token if it           changes. Based on a patch by Miroslav Jezbera. (markt)
      * Coyote
        - Fix: 69575: Avoid using compression if a response is already compressed           using compress, deflate or zstd. (remm)
        - Update: Use Transfer-Encoding for compression rather than Content-Encoding           if the client submits a TE header containing gzip. (remm)
        - Fix: Fix a race condition in the handling of HTTP/2 stream reset that           could cause unexpected 500 responses. (markt)
      * Other
        - Add: Add makensis as an option for building the Installer for Windows on           non-Windows platforms. (rjung/markt)
        - Update: Update Byte Buddy to 1.17.1. (markt)
        - Update: Update Checkstyle to 10.21.3. (markt)
        - Update: Update SpotBugs to 4.9.1. (markt)
        - Update: Update JSign to 7.1. (markt)
        - Add: Improvements to French translations. (remm)
        - Add: Improvements to Japanese translations by tak7iji. (markt)
        - Add: Add org.apache.juli.JsonFormatter to format log as one line JSON           documents. (remm)

    - Update to Tomcat 10.1.35
      * Catalina
        - Update: Add tableName configuration on the DataSourcePropertyStore that           may be used by the WebDAV Servlet. (remm)
        - Update: Improve HTTP If headers processing according to RFC 9110. Based on           pull request #796 by Chenjp. (remm/markt)
        - Update: Allow readOnly attribute configuration on the Resources element           and allow configure the readOnly attribute value of the main resources.
          The attribute value will also be used by the default and WebDAV Servlets.
          (remm)         + Fix: 69285: Optimise the creation of the parameter map for included           requests. Based on sample code and test cases provided by John           Engebretson. (markt)         + Fix: 69527: Avoid rare cases where a cached resource could be set with 0           content length, or could be evicted immediately. (remm)         + Fix: Fix possible edge cases (such as HTTP/1.0) with trying to detect           requests without body for WebDAV LOCK and PROPFIND. (remm)         + Fix: 69528: Add multi-release JAR support for the bloom           archiveIndexStrategy of the Resources. (remm)         + Fix: Improve checks for WEB-INF and META-INF in the WebDAV servlet. Based           on a patch submitted by Chenjp. (remm)         + Fix: Remove unused session to client map from CrawlerSessionManagerValve.
          Submitted by Brian Matzon. (remm)         + Add: Add a check to ensure that, if one or more web applications are           potentially vulnerable to CVE-2024-56337, the JVM has been configured to           protect against the vulnerability and to configure the JVM correctly if           not. Where one or more web applications are potentially vulnerable to           CVE-2024-56337 and the JVM cannot be correctly configured or it cannot be           confirmed that the JVM has been correctly configured, prevent the impacted           web applications from starting. (markt)         + Fix: When using the WebDAV servlet with serveSubpathOnly set to true,           ensure that the destination for any requested WebDAV operation is also           restricted to the sub-path. (markt)         + Fix: Generate an appropriate Allow HTTP header when the Default servlet           returns a 405 (method not allowed) response in response to a DELETE           request because the target resource cannot be deleted. Pull request #802           provided by Chenjp. (markt)         + Code: Refactor creation of RequestDispatcher instances so that the           processing of the provided path is consistent with normal request           processing. (markt)         + Add: Add encodedReverseSolidusHandling and encodedSolidusHandling           attributes to Context to provide control over the handling of the path           used to created a RequestDispatcher. (markt)         + Fix: Handle a potential NullPointerException after an IOException occurs           on a non-container thread during asynchronous processing. (markt)         + Fix: Enhance lifecycle of temporary files used by partial PUT. (remm)
      * Coyote         + Fix: Don't log warnings for registered HTTP/2 settings that Tomcat does           not support. These settings are now silently ignored. (markt)         + Fix: Avoid a rare NullPointerException when recycling the           Http11InputBuffer. (markt)         + Fix: Lower the log level to debug for logging an invalid socket channel           when processing poller events for the NIO Connector as this may occur in           normal usage. (markt)         + Code: Clean-up references to the HTTP/2 stream once request processing has           completed to aid GC and reduce the size of the HTTP/2 recycled request and           response cache. (markt)         + Add: Add a new Connector configuration attribute,           encodedReverseSolidusHandling, to control how %5c sequences in URLs are           handled. The default behaviour is unchanged (decode) keeping in mind that           the allowBackslash attribute determines how the decoded URI is processed.
          (markt)         + Fix: 69545: Improve CRLF skipping for the available method of the           ChunkedInputFilter. (remm)         + Fix: Improve the performance of repeated calls to getHeader(). Pull           request #813 provided by Adwait Kumar Singh. (markt)         + Fix: 69559: Ensure that the Java 24 warning regarding the use of           sun.misc.Unsafe::invokeCleaner is only reported by the JRE when the code           will be used. (markt)
      * Jasper         + Fix: 69508: Correct a regression in the fix for 69382 that broke JSP           include actions if both the page attribute and the body contained           parameters. Pull request #803 provided by Chenjp. (markt)         + Fix: Update the identifier validation in the Expression Language parser to           reflect that, as of Java 9, _ is also a Java keyword and may not be used           as an identifier. (markt)         + Fix: 69521: Update the EL Parser to allow the full range of valid           characters in an EL identifier as defined by the Java Language           Specification. (markt)         + Fix: 69532: Optimise the creation of ExpressionFactory instances. Patch           provided by John Engebretson. (markt)
      * Web applications         + Add: Documentation. Expand the description of the security implications of           setting mapperContextRootRedirectEnabled and/or           mapperDirectoryRedirectEnabled to true. (markt)         + Fix: Documentation. Better document the default for the truststoreProvider           attribute of a SSLHostConfig element. (markt)
      * Other         + Update: Update to Commons Daemon 1.4.1. (markt)         + Update: Update the packaged version of the Tomcat Migration Tool for           Jakarta EE to 1.0.9. (markt)         + Update: Update the internal fork of Commons Pool to 2.12.1. (markt)         + Update: Update Byte Buddy to 1.16.1. (markt)         + Update: Update UnboundID to 7.0.2. (markt)         + Update: Update Checkstyle to 10.21.2. (markt)         + Update: Update SpotBugs to 4.9.0. (markt)         + Add: Improvements to French translations. (remm)         + Add: Improvements to Chinese translations by leeyazhou. (markt)         + Add: Improvements to Japanese translations by tak7iji. (markt)         + Add: Improvements to Japanese translations by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through     9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file     system with the default servlet write enabled (readonly initialisation parameter set to the non-default     value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which     version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property     sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the     system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on     Java 21 onwards: no further configuration is required (the system property and the problematic cache have     been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is     set appropriately before allowing the default servlet to be write enabled on a case insensitive file     system. Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-99216 advisory.

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through     9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file     system with the default servlet write enabled (readonly initialisation parameter set to the non-default     value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which     version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property     sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the     system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on     Java 21 onwards: no further configuration is required (the system property and the problematic cache have     been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is     set appropriately before allowing the default servlet to be write enabled on a case insensitive file     system. Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the apache package has been released.

The version of tomcat installed on the remote host is prior to 9.0.98-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2025-015 advisory.

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration).

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-50379)

    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta     Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the     authentication process without explicitly setting an HTTP status to indicate failure, the authentication     may not fail, allowing the user to bypass the authentication process. There are no known Jakarta     Authentication components that behave in this way.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from     9.0.0-M1 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
    (CVE-2024-52316)

    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.9.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-54677)

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    The mitigation for CVE-2024-50379 was incomplete.

    Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly     initialisationparameter set to the non-default value of false) may need additional configuration to fully     mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:- running on Java 8     or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to     true)- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it     defaults to false)- running on Java 21 onwards: no further configuration is required (the system property     and the problematic cache have been removed)

    Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set     appropriately before allowing the default servlet to be write enabled on a case insensitive file system.
    Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-814 advisory.

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration).

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-50379)

    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta     Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the     authentication process without explicitly setting an HTTP status to indicate failure, the authentication     may not fail, allowing the user to bypass the authentication process. There are no known Jakarta     Authentication components that behave in this way.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from     9.0.0-M1 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
    (CVE-2024-52316)

    Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request     and response used by HTTP/2 requestscould lead to request and/or response mix-up between users.

    This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from     9.0.92 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.
    (CVE-2024-52317)

    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.9.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-54677)

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    The mitigation for CVE-2024-50379 was incomplete.

    Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly     initialisationparameter set to the non-default value of false) may need additional configuration to fully     mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:- running on Java 8     or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to     true)- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it     defaults to false)- running on Java 21 onwards: no further configuration is required (the system property     and the problematic cache have been removed)

    Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set     appropriately before allowing the default servlet to be write enabled on a case insensitive file system.
    Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-813 advisory.

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration).

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-50379)

    Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta     Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the     authentication process without explicitly setting an HTTP status to indicate failure, the authentication     may not fail, allowing the user to bypass the authentication process. There are no known Jakarta     Authentication components that behave in this way.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from     9.0.0-M1 through 9.0.95.

    Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
    (CVE-2024-52316)

    Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.9.97.

    Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
    (CVE-2024-54677)

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.

    This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from     9.0.0.M1 through 9.0.97.

    The mitigation for CVE-2024-50379 was incomplete.

    Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly     initialisationparameter set to the non-default value of false) may need additional configuration to fully     mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:- running on Java 8     or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to     true)- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it     defaults to false)- running on Java 21 onwards: no further configuration is required (the system property     and the problematic cache have been removed)

    Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set     appropriately before allowing the default servlet to be write enabled on a case insensitive file system.
    Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5845 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5845-1                   security@debian.org     https://www.debian.org/security/                          Markus Koschany     January 17, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : tomcat10     CVE ID         : CVE-2024-34750 CVE-2024-38286 CVE-2024-50379 CVE-2024-52316                      CVE-2024-54677 CVE-2024-56337

    Several problems have been addressed in Tomcat 10, a Java based web server,     servlet and JSP engine which may lead to a denial-of-service.


    CVE-2024-38286

        Apache Tomcat, under certain configurations, allows an attacker to cause an         OutOfMemoryError by abusing the TLS handshake process.

    CVE-2024-52316

        Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is         configured to use a custom Jakarta Authentication (formerly JASPIC)         ServerAuthContext component which may throw an exception during the         authentication process without explicitly setting an HTTP status to         indicate failure, the authentication may not fail, allowing the user to         bypass the authentication process. There are no known Jakarta         Authentication components that behave in this way.

    CVE-2024-50379 / CVE-2024-56337

        Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP         compilation in Apache Tomcat permits an RCE on case insensitive file         systems when the default servlet is enabled for write (non-default         configuration).
        Some users may need additional configuration to fully mitigate         CVE-2024-50379 depending on which version of Java they are using with         Tomcat. For Debian 12 bookworm the system property         sun.io.useCanonCaches must be explicitly set to false (it defaults to         false). Most Debian users will not be affected because Debian uses case         sensitive file systems by default.

    CVE-2024-34750

        Improper Handling of Exceptional Conditions, Uncontrolled Resource         Consumption vulnerability in Apache Tomcat. When processing an HTTP/2         stream, Tomcat did not handle some cases of excessive HTTP headers         correctly. This led to a miscounting of active HTTP/2 streams which in turn         led to the use of an incorrect infinite timeout which allowed connections         to remain open which should have been closed.

    CVE-2024-54677

        Uncontrolled Resource Consumption vulnerability in the examples web         application provided with Apache Tomcat leads to denial of service.


    For the stable distribution (bookworm), these problems have been fixed in     version 10.1.34-0+deb12u1.

    We recommend that you upgrade your tomcat10 packages.

    For the detailed security status of tomcat10 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tomcat10

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4017 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4017-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     January 17, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : tomcat9     Version        : 9.0.43-2~deb11u11     CVE ID         : CVE-2024-21733 CVE-2024-38286 CVE-2024-50379 CVE-2024-52316                      CVE-2024-56337

    Several problems have been addressed in Tomcat 9, a Java based web server,     servlet and JSP engine which may lead to a denial-of-service or the disclosure     of sensitive information.

    CVE-2024-21733

        Generation of Error Message Containing Sensitive Information vulnerability         in Apache Tomcat.

    CVE-2024-38286

        Apache Tomcat, under certain configurations, allows an attacker to cause an         OutOfMemoryError by abusing the TLS handshake process.

    CVE-2024-52316

        Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is         configured to use a custom Jakarta Authentication (formerly JASPIC)         ServerAuthContext component which may throw an exception during the         authentication process without explicitly setting an HTTP status to         indicate failure, the authentication may not fail, allowing the user to         bypass the authentication process. There are no known Jakarta         Authentication components that behave in this way.

    CVE-2024-50379 / CVE-2024-56337

        Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP         compilation in Apache Tomcat permits an RCE on case insensitive file         systems when the default servlet is enabled for write (non-default         configuration).
        Some users may need additional configuration to fully mitigate         CVE-2024-50379 depending on which version of Java they are using with         Tomcat. For Debian 11 bullseye the system property         sun.io.useCanonCaches must be explicitly set to false (it defaults to         true). Most Debian users will not be affected because Debian uses case         sensitive file systems by default.

    For Debian 11 bullseye, these problems have been fixed in version     9.0.43-2~deb11u11.

    We recommend that you upgrade your tomcat9 packages.

    For the detailed security status of tomcat9 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tomcat9

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0058-1 advisory.

    Update to Tomcat 9.0.98

    - Fixed CVEs:
      - CVE-2024-54677: DoS in examples web application (bsc#1234664)
      - CVE-2024-50379: RCE due to TOCTOU issue in JSP compilation (bsc#1234663)
      - CVE-2024-52317: Request/response mix-up with HTTP/2 (bsc#1233435)
    - Catalina
      - Add: Add option to serve resources from subpath only with WebDAV Servlet         like with DefaultServlet. (michaelo)
      - Fix: Add special handling for the protocols attribute of SSLHostConfig in         storeconfig. (remm)
      - Fix: 69442: Fix case sensitive check on content-type when parsing request         parameters. (remm)
      - Code: Refactor duplicate code for extracting media type and subtype from         content-type into a single method. (markt)
      - Fix: Compatibility of generated embedded code with components where         constructors or property related methods throw a checked exception. (remm)
      - Fix: The previous fix for inconsistent resource metadata during concurrent         reads and writes was incomplete. (markt)
      - Fix: 69444: Ensure that the javax.servlet.error.message request attribute         is set when an application defined error page is called. (markt)
      - Fix: Avoid quotes for numeric values in the JSON generated by the status         servlet. (remm)
      - Add: Add strong ETag support for the WebDAV and default servlet, which can         be enabled by using the useStrongETags init parameter with a value set to         true. The ETag generated will be a SHA-1 checksum of the resource content.
        (remm)
      - Fix: Use client locale for directory listings. (remm)
      - Fix: 69439: Improve the handling of multiple Cache-Control headers in the         ExpiresFilter. Based on pull request #777 by Chenjp. (markt)
      - Fix: 69447: Update the support for caching classes the web application         class loader cannot find to take account of classes loaded from external         repositories. Prior to this fix, these classes could be incorrectly marked         as not found. (markt)
      - Fix: 69466: Rework handling of HEAD requests. Headers explicitly set by         users will not be removed and any header present in a HEAD request will         also be present in the equivalent GET request. There may be some headers,         as per RFC 9110, section 9.3.2, that are present in a GET request that are         not present in the equivalent HEAD request. (markt)
      - Fix: 69471: Log instances of CloseNowException caught by         ApplicationDispatcher.invoke() at debug level rather than error level as         they are very likely to have been caused by a client disconnection or         similar I/O issue. (markt)
      - Add: Add a test case for the fix for 69442. Also refactor references to         application/x-www-form-urlencoded. Based on pull request #779 by Chenjp.
        (markt)
      - Fix: 69476: Catch possible ISE when trying to report PUT failure in the         DefaultServlet. (remm)
      - Add: Add support for RateLimit header fields for HTTP (draft) in the         RateLimitFilter. Based on pull request #775 provided by Chenjp. (markt)
      - Add: #787: Add regression tests for 69478. Pull request provided by Thomas         Krisch. (markt)
      - Fix: The default servlet now rejects HTTP range requests when two or more         of the requested ranges overlap. Based on pull request #782 provided by         Chenjp. (markt)
      - Fix: Enhance Content-Range verification for partial PUT requests handled         by the default servlet. Provided by Chenjp in pull request #778. (markt)
      - Fix: Harmonize DataSourceStore lookup in the global resources to         optionally avoid the comp/env prefix which is usually not used there.
        (remm)       + Fix: As required by RFC 9110, the HTTP Range header will now only be         processed for GET requests. Based on pull request #790 provided by Chenjp.
        (markt)       + Fix: Deprecate the useAcceptRanges initialisation parameter for the         default servlet. It will be removed in Tomcat 12 onwards where it will         effectively be hard coded to true. (markt)       + Add: Add DataSource based property storage for the WebdavServlet. (remm)
    - Coyote       + Fix: Align encodedSolidusHandling with the Servlet specification. If the         pass-through mode is used, any %25 sequences will now also be passed         through to avoid errors and/or corruption when the application decodes the         path. (markt)
    - Jasper       + Fix: Further optimise EL evaluation of method parameters. Patch provided         by Paolo B. (markt)       + Fix: Follow-up to the fix for 69381. Apply the optimisation for method         lookup performance in expression language to an additional location.
        (markt)
    - Web applications       + Fix: Documentation. Remove references to the ResourceParams element.
        Support for ResourceParams was removed in Tomcat 5.5.x. (markt)       + Fix: Documentation. 69477: Correct name of attribute for RemoteIPFilter.
        The attribute is internalProxies rather than allowedInternalProxies. Pull         request #786 (markt)       + Fix: Examples. Fix broken links when Servlet Request Info example is         called via a URL that includes a pathInfo component. (markt)       + Fix: Examples. Expand the obfuscation of session cookie values in the         request header example to JSON responses. (markt)       + Add: Examples. Add the ability to delete session attributes in the servlet         session example. (markt)       + Add: Examples. Add a hard coded limit of 10 attributes per session for the         servlet session example. (markt)       + Add: Examples. Add the ability to delete session attributes and add a hard         coded limit of 10 attributes per session for the JSP form authentication         example. (markt)       + Add: Examples. Limit the shopping cart example to only allow adding the         pre-defined items to the cart. (markt)       + Fix: Examples. Remove JSP calendar example. (markt)
    - Other       + Fix: 69465: Fix warnings during native image compilation using the Tomcat         embedded JARs. (markt)       + Update: Update Tomcat's fork of Commons DBCP to 2.13.0. (markt)       + Update: Update EasyMock to 5.5.0. (markt)       + Update: Update Checkstyle to 10.20.2. (markt)       + Update: Update BND to 7.1.0. (markt)       + Add: Improvements to French translations. (remm)       + Add: Improvements to Korean translations. (markt)       + Add: Improvements to Chinese translations. (markt)       + Add: Improvements to Japanese translations by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0033-1 advisory.

    Update to Tomcat 10.1.34

    - Fixed CVEs:
      - CVE-2024-54677: DoS in examples web application (bsc#1234664)
      - CVE-2024-50379: RCE due to TOCTOU issue in JSP compilation (bsc#1234663)
      - CVE-2024-52317: Request/response mix-up with HTTP/2 (bsc#1233435)
      - CVE-2024-56337: RCE due to TOCTOU issue in JSP compilation - mitigation was incomplete
    - Catalina
      - Add: Add option to serve resources from subpath only with WebDAV Servlet         like with DefaultServlet. (michaelo)
      - Fix: Add special handling for the protocols attribute of SSLHostConfig in         storeconfig. (remm)
      - Fix: 69442: Fix case sensitive check on content-type when parsing request         parameters. (remm)
      - Code: Refactor duplicate code for extracting media type and subtype from         content-type into a single method. (markt)
      - Fix: Compatibility of generated embedded code with components where         constructors or property related methods throw a checked exception. (remm)
      - Fix: The previous fix for inconsistent resource metadata during concurrent         reads and writes was incomplete. (markt)
      - Fix: #780: Fix content-range header length. Submitted by Chenjp. (remm)
      - Fix: 69444: Ensure that the jakarta.servlet.error.message request         attribute is set when an application defined error page is called. (markt)
      - Fix: Avoid quotes for numeric values in the JSON generated by the status         servlet. (remm)
      - Add: Add strong ETag support for the WebDAV and default servlet, which can         be enabled by using the useStrongETags init parameter with a value set to         true. The ETag generated will be a SHA-1 checksum of the resource content.
        (remm)
      - Fix: Use client locale for directory listings. (remm)
      - Fix: 69439: Improve the handling of multiple Cache-Control headers in the         ExpiresFilter. Based on pull request #777 by Chenjp. (markt)
      - Fix: 69447: Update the support for caching classes the web application         class loader cannot find to take account of classes loaded from external         repositories. Prior to this fix, these classes could be incorrectly marked         as not found. (markt)
      - Fix: 69466: Rework handling of HEAD requests. Headers explicitly set by         users will not be removed and any header present in a HEAD request will         also be present in the equivalent GET request. There may be some headers,         as per RFC 9110, section 9.3.2, that are present in a GET request that are         not present in the equivalent HEAD request. (markt)
      - Fix: 69471: Log instances of CloseNowException caught by         ApplicationDispatcher.invoke() at debug level rather than error level as         they are very likely to have been caused by a client disconnection or         similar I/O issue. (markt)
      - Add: Add a test case for the fix for 69442. Also refactor references to         application/x-www-form-urlencoded. Based on pull request #779 by Chenjp.
        (markt)
      - Fix: 69476: Catch possible ISE when trying to report PUT failure in the         DefaultServlet. (remm)
      - Add: Add support for RateLimit header fields for HTTP (draft) in the         RateLimitFilter. Based on pull request #775 provided by Chenjp. (markt)
      - Add: #787: Add regression tests for 69478. Pull request provided by Thomas         Krisch. (markt)
      - Fix: The default servlet now rejects HTTP range requests when two or more         of the requested ranges overlap. Based on pull request #782 provided by         Chenjp. (markt)       + Fix: Enhance Content-Range verification for partial PUT requests handled         by the default servlet. Provided by Chenjp in pull request #778. (markt)       + Fix: Harmonize DataSourceStore lookup in the global resources to         optionally avoid the comp/env prefix which is usually not used there.
        (remm)       + Fix: As required by RFC 9110, the HTTP Range header will now only be         processed for GET requests. Based on pull request #790 provided by Chenjp.
        (markt)       + Fix: Deprecate the useAcceptRanges initialisation parameter for the         default servlet. It will be removed in Tomcat 12 onwards where it will         effectively be hard coded to true. (markt)       + Add: Add DataSource based property storage for the WebdavServlet. (remm)
    - Coyote       + Fix: Align encodedSolidusHandling with the Servlet specification. If the         pass-through mode is used, any %25 sequences will now also be passed         through to avoid errors and/or corruption when the application decodes the         path. (markt)
    - Jasper       + Fix: Follow-up to the fix for 69381. Apply the optimisation for method         lookup performance in expression language to an additional location.
        (markt)
    - Web applications       + Fix: Documentation. Remove references to the ResourceParams element.
        Support for ResourceParams was removed in Tomcat 5.5.x. (markt)       + Fix: Documentation. 69477: Correct name of attribute for RemoteIPFilter.
        The attribute is internalProxies rather than allowedInternalProxies. Pull         request #786 (markt)       + Fix: Examples. Fix broken links when Servlet Request Info example is         called via a URL that includes a pathInfo component. (markt)       + Fix: Examples. Expand the obfuscation of session cookie values in the         request header example to JSON responses. (markt)       + Add: Examples. Add the ability to delete session attributes in the servlet         session example. (markt)       + Add: Examples. Add a hard coded limit of 10 attributes per session for the         servlet session example. (markt)       + Add: Examples. Add the ability to delete session attributes and add a hard         coded limit of 10 attributes per session for the JSP form authentication         example. (markt)       + Add: Examples. Limit the shopping cart example to only allow adding the         pre-defined items to the cart. (markt)       + Fix: Examples. Remove JSP calendar example. (markt)
    - Other       + Fix: 69465: Fix warnings during native image compilation using the Tomcat         embedded JARs. (markt)       + Update: Update Tomcat's fork of Commons DBCP to 2.13.0. (markt)       + Update: Update EasyMock to 5.5.0. (markt)       + Update: Update Checkstyle to 10.20.2. (markt)       + Update: Update BND to 7.1.0. (markt)       + Add: Improvements to French translations. (remm)       + Add: Improvements to Korean translations. (markt)       + Add: Improvements to Chinese translations. (markt)       + Add: Improvements to Japanese translations by tak7iji. (markt)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ed0a052a-c5e6-11ef-a457-b42e991fc52e advisory.

    security@apache.org reports:
    Time-of-check Time-of-use (TOCTOU) Race Condition             The mitigation for CVE-2024-50379 was incomplete.
            Users running Tomcat on a case insensitive file system with the             default servlet write enabled (readonly initialisation parameter             set to the non-default value of false) may need additional configuration             to fully mitigate CVE-2024-50379 depending on which version of Java             they are using with Tomcat: - running on Java 8 or Java 11: the             system propertysun.io.useCanonCaches must be explicitly set to false             (it defaults to true) - running on Java 17: thesystem property             sun.io.useCanonCaches, if set, must be set to false(it defaults to             false) - running on Java 21 onwards: no further configuration is             required(the system property and the problematic cache have been             removed)             Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks             thatsun.io.useCanonCaches is set appropriately before allowing the             default servlet to be write enabled on a case insensitive file             system.  Tomcat will also setsun.io.useCanonCaches to false by             default where it can.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is 9.0.0-M1 to 9.0.97, 10.1.0-M1 to 10.1.33 or 11.0.0-M1 to 11.0.1. It is, therefore, affected by multiple vulnerabilities :

 - The previous mitigation for CVE-2024-50379 was incomplete. In addition to upgrading to 11.0.2 or later, users running Tomcat on a case insensitive file system with the default servlet write enabled may need additional configuration depending on the version of Java being used. (CVE-2024-56337)

 - Numerous examples in the examples web application did not place limits on uploaded data enabling an OutOfMemoryError to be triggered causing a denial of service. (CVE-2024-54677)

 - If the default servlet is write enabled (readonly initialisation parameter set to the non-default value of false) for a case insensitive file system, concurrent read and upload under load of the same file can bypass Tomcat's case sensitivity checks and cause an uploaded file to be treated as a JSP leading to remote code execution. (CVE-2024-50379)

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.98. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.98_security-9 advisory.

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through     10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or     9.0.98, which fixes the issue. (CVE-2024-50379)

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through     9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file     system with the default servlet write enabled (readonly initialisation parameter set to the non-default     value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which     version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property     sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the     system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on     Java 21 onwards: no further configuration is required (the system property and the problematic cache have     been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is     set appropriately before allowing the default servlet to be write enabled on a case insensitive file     system. Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

  - Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from     10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. Users are recommended to upgrade to version     11.0.2, 10.1.34 or 9.0.98, which fixes the issue. (CVE-2024-54677)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 10.1.34. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.34_security-10 advisory.

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through     10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or     9.0.98, which fixes the issue. (CVE-2024-50379)

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through     9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file     system with the default servlet write enabled (readonly initialisation parameter set to the non-default     value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which     version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property     sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the     system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on     Java 21 onwards: no further configuration is required (the system property and the problematic cache have     been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is     set appropriately before allowing the default servlet to be write enabled on a case insensitive file     system. Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

  - Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from     10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. Users are recommended to upgrade to version     11.0.2, 10.1.34 or 9.0.98, which fixes the issue. (CVE-2024-54677)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 11.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_11.0.2_security-11 advisory.

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat     permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default     configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through     10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or     9.0.98, which fixes the issue. (CVE-2024-50379)

  - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects     Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through     9.0.97. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file     system with the default servlet write enabled (readonly initialisation parameter set to the non-default     value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which     version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property     sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the     system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on     Java 21 onwards: no further configuration is required (the system property and the problematic cache have     been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is     set appropriately before allowing the default servlet to be write enabled on a case insensitive file     system. Tomcat will also set sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

  - Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache     Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from     10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. Users are recommended to upgrade to version     11.0.2, 10.1.34 or 9.0.98, which fixes the issue. (CVE-2024-54677)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
235615	RHEL 7 / 8 / 9 : Red Hat JBoss Web Server 5.8.4 (RHSA-2025:4521)	Nessus	Red Hat Local Security Checks	critical
233841	SUSE SLES15 / openSUSE 15 Security Update : tomcat (SUSE-SU-2025:1126-1)	Nessus	SuSE Local Security Checks	critical
233402	SUSE SLES15 / openSUSE 15 Security Update : tomcat10 (SUSE-SU-2025:1024-1)	Nessus	SuSE Local Security Checks	critical
231438	Linux Distros Unpatched Vulnerability : CVE-2024-56337	Nessus	Misc.	critical
216688	Atlassian Confluence 6.10.x < 8.5.19 / 8.6.x < 9.2.1 (CONFSERVER-99216)	Nessus	CGI abuses	critical
215224	Photon OS 5.0: Apache PHSA-2025-5.0-0445	Nessus	PhotonOS Local Security Checks	critical
214622	Amazon Linux 2 : tomcat (ALASTOMCAT9-2025-015)	Nessus	Amazon Linux Local Security Checks	critical
214611	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2025-814)	Nessus	Amazon Linux Local Security Checks	critical
214604	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-813)	Nessus	Amazon Linux Local Security Checks	critical
214338	Debian dsa-5845 : libtomcat10-embed-java - security update	Nessus	Debian Local Security Checks	high
214321	Debian dla-4017 : libtomcat9-embed-java - security update	Nessus	Debian Local Security Checks	medium
214266	Photon OS 4.0: Apache PHSA-2025-4.0-0729	Nessus	PhotonOS Local Security Checks	critical
213973	SUSE SLES15 / openSUSE 15 Security Update : tomcat (SUSE-SU-2025:0058-1)	Nessus	SuSE Local Security Checks	critical
213596	SUSE SLES15 / openSUSE 15 Security Update : tomcat10 (SUSE-SU-2025:0033-1)	Nessus	SuSE Local Security Checks	critical
213442	FreeBSD : Apache Tomcat -- RCE due to TOCTOU issue in JSP compilation (ed0a052a-c5e6-11ef-a457-b42e991fc52e)	Nessus	FreeBSD Local Security Checks	critical
114548	Apache Tomcat 9.0.0-M1 < 9.0.98 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114547	Apache Tomcat 10.1.0-M1 < 10.1.34 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114546	Apache Tomcat 11.0.0-M1 < 11.0.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
213078	Apache Tomcat 9.0.0.M1 < 9.0.98 multiple vulnerabilities	Nessus	Web Servers	critical
213077	Apache Tomcat 10.1.0.M1 < 10.1.34 multiple vulnerabilities	Nessus	Web Servers	critical
213076	Apache Tomcat 11.0.0.M1 < 11.0.2 multiple vulnerabilities	Nessus	Web Servers	critical

Detections

Analytics

CVE-2024-56337

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical