CVE-2024-56337

Summary

CVE-2024-56337 is a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability identified in Apache Tomcat. Affected versions include those from Tomcat 11.0.0-M1 to 11.0.1, 10.1.0-M1 to 10.1.33, and 9.0.0.M1 to 9.0.97. The previous mitigation for CVE-2024-50379 was incomplete, and users on a case-insensitive file system with the default servlet write enabled (readonly initialization parameter set to false) require additional configuration to fully address the issue. Java 8 and Java 11 users need to set the sun.io.useCanonCaches system property to false, while Java 17 users must ensure this property is not set. Tomcat 11.0.3, 10.1.35, and 9.0.99 onwards will include checks for sun.io.useCanonCaches and set it to false by default on case-insensitive file systems.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.