Detections
Analytics

SCA: security update for org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-embed-core (GHSA-27hp-xhwr-wr2m)

critical Tenable Cloud Security Plugin ID 408765

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects
 Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through
 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected:
 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379
 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write
 enabled (readonly initialisation parameter set to the non-default value of false) may need additional
 configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with
 Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set
 to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set,
 must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is
 required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and
 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the
 default servlet to be write enabled on a case insensitive file system. Tomcat will also set
 sun.io.useCanonCaches to false by default where it can. (CVE-2024-56337)

See Also

https://github.com/advisories/GHSA-27hp-xhwr-wr2m

Plugin Details

Severity: Critical

ID: 408765

Version: Revision 1.15

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 99.1

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-56337

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.2

Threat Score: 8.2

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/20/2024

Vulnerability Publication Date: 12/9/2024

Reference Information

CVE: CVE-2024-56337

cwe: CWE-367