🛡️ CVE-2024-56337 on Debian — tomcat10

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. The mitigation for CVE-2024-50379 was incomplete. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.

Distribution advisory

This page covers CVE-2024-56337 as tracked by Debian, for the package tomcat10. The fix is available in version 10.1.34-1; earlier versions remain affected.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity high, availability high.

Weakness class

DEBIAN-CVE-2024-56337 is classified as CWE-367: Time-of-check Time-of-use Race Condition. The state checked and the state acted upon can differ, because it may change between the two steps.

Affected software

DEBIAN-CVE-2024-56337 is recorded against 2 packages.

  • tomcat10 (fixed in 10.1.34-1)
  • tomcat9 (fixed in 9.0.70-2)

Timeline and source

Published on 20 December 2024 and last revised on 4 August 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

security-tracker.debian.org (Advisory)

CVE-2024-56337 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Severity Unknown
CVSS Score N/A
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2024-12-20
Updated 2026-08-20
Modified 2026-08-04
Fix URL N/A

Affected Packages

Software From version Fixed in
tomcat10 — 10.1.34-1
tomcat9 — 9.0.70-2

Exploit Protection

Are you running tomcat10?

DEBIAN-CVE-2024-56337 carries CVSS 9.8 Critical rating. BotEraser checks your installation against this and other known CVE records, and blocks IPs associated with exploit activity.

Check My Site For DEBIAN-CVE-2024-56337 →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Browse related advisories

All advisoriesDebianDebian 2024