# Apache fixes remote code execution bypass in Tomcat web server

**<mark>December 23, 2024</mark>**

---

**<mark>Apache</mark>** has released a security update that addresses an important vulnerability in Tomcat web server that could lead to an attacker achieving **<mark>remote code execution</mark>**.

**<mark>Apache Tomcat is an open-source web server</mark>** and servlet container widely used to deploy and run Java-based web applications. It provides **<mark>a runtime environment for Java Servlets, JavaServer Pages (JSP), and Java WebSocket technologies.</mark>**

The product is popular with large enterprises that run custom web apps, SaaS providers that rely on Java for backend services. Cloud and hosting services integrateTomcat for app hosting, and **<mark>software developers use it to build, test, and deploy web apps.</mark>**

The vulnerability fixed in the new release is tracked as **<mark> CVE-2024-56337</mark>** and addresses an incomplete mitigation for CVE-2024-50379, a **<mark> critical remote code execution (RCE)</mark>**, for which the vendor released a patch on December 17.

However, the team realized that applying the update for CVE-2024-50379 wouldn't be enough to secure systems, and **<mark>decided to issue CVE-2024-56337 to highlight the need for manual action.</mark>**

**<mark>Both flaws are essentially exactly the same vulnerability</mark>**, but the use of a new CVE ID was decided on the basis of raising awareness on impacted system administrators.

The security issue is a **<mark> time-of-check time-of-use (TOCTOU) race condition vulnerability that affects systems with the default servlet write enabled ('readonly' initialization parameter set to false) and running on case-insensitive file systems.</mark>**

The issue affects **<mark>Apache Tomcat 11.0.0-M1 through 11.0.1, 10.1.0-M1 through 10.1.33, and 9.0.0.M1 through 9.0.97.</mark>**

Users should upgrade to the **<mark>latest Tomcat versions: 11.0.2, 10.1.34, and 9.0.98.</mark>**

Addressing the issue requires additional steps. Depending on the Java version in use, users need to perform the following actions, **<mark>besides upgrading</mark>**:

* For Java 8 or 11, it is recommended to set the system property ‘[sun.io](http://sun.io).useCanonCaches’ to ‘false’ (default: true).
    
* For Java 17, ensure ‘[sun.io](http://sun.io).useCanonCaches,’ if set, is configured as false (default: false).
    
* For Java 21 and later, no configuration is needed. The property and problematic cache have been removed.
    

The Apache team shared plans for security enhancements in the upcoming **<mark> versions of Tomcat, 11.0.3, 10.1.35, and 9.0.99.</mark>**

Specifically, Tomcat will check that ‘[sun.io](http://sun.io).useCanonCaches’ is set correctly before enabling write access for the default servlet on case-insensitive file systems, and will default ‘[sun.io](http://sun.io).useCanonCaches’ to false where possible.

**<mark>These changes aim to enforce safer configurations automatically and reduce the risk of exploitation of CVE-2024-50379 and CVE-2024-56337.</mark>**