Threats Tagged 'cve-2024-50379'

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library. This release of Red Hat JBoss Web Server 5.8.2 serves as a replacement for Red Hat JBoss Web Server 5.8.1. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section. Security Fix(es): * tomcat: RCE due to TOCTOU issue in JSP compilation [jws-5] (CVE-2024-50379) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat has issued a moderate severity security advisory for Apache Tomcat addressing two vulnerabilities: CVE-2024-50379, a remote code execution (RCE) due to a time-of-check to time-of-use (TOCTOU) issue in JSP compilation, and CVE-2025-24813, which may allow RCE, information disclosure, or information corruption via partial PUT requests. The advisory provides updated Tomcat packages for Red Hat Enterprise Linux 9.2 Extended Update Support and related variants. Users are advised to apply the provided updates to mitigate these issues.

Red Hat has issued a moderate severity security advisory for Apache Tomcat addressing two vulnerabilities: CVE-2024-50379, a remote code execution (RCE) due to a time-of-check to time-of-use (TOCTOU) issue in JSP compilation, and CVE-2025-24813, which involves potential RCE, information disclosure, or information corruption via partial PUT requests. The update is available for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. Users are advised to apply the provided patches to mitigate these issues.

Red Hat has issued a security advisory for Apache Tomcat addressing two vulnerabilities: CVE-2024-50379, a remote code execution (RCE) vulnerability caused by a time-of-check to time-of-use (TOCTOU) issue in JSP compilation, and CVE-2025-24813, which may allow RCE, information disclosure, or information corruption via partial PUT requests. The update is rated as having moderate security impact. Red Hat Enterprise Linux 8.8 Extended Update Support versions are affected, and updated packages are available to remediate these issues.

This advisory addresses two security vulnerabilities in Apache Tomcat as packaged by Red Hat for Red Hat Enterprise Linux 9. The first vulnerability (CVE-2024-50379) involves a time-of-check to time-of-use (TOCTOU) issue in JSP compilation that could lead to remote code execution (RCE). The second vulnerability (CVE-2025-24813) involves potential remote code execution, information disclosure, or information corruption via partial HTTP PUT requests. Red Hat has released updated Tomcat packages to remediate these issues. The update is rated with moderate severity by Red Hat Product Security.

Red Hat has issued a security advisory for Apache Tomcat addressing two vulnerabilities: CVE-2024-50379, a remote code execution (RCE) due to a time-of-check to time-of-use (TOCTOU) issue in JSP compilation, and CVE-2025-24813, which may allow potential RCE, information disclosure, or information corruption via partial PUT requests. The update is rated as having a moderate security impact. Red Hat Enterprise Linux 8 and its extended life cycle variants across multiple architectures are affected. A security update is available to remediate these issues.