CVE-2024-22029 - Vulnerability Details - OpenCVE

ReportizFlow

Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://bugzilla.suse.com/show_bug.cgi?id=1219208
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22029
https://bz.apache.org/bugzilla/show_bug.cgi?id=68663
https://nvd.nist.gov/vuln/detail/CVE-2024-22029
https://www.cve.org/CVERecord?id=CVE-2024-22029

History

Wed, 16 Oct 2024 13:45:00 +0000

Type	Values Removed	Values Added
Description	A flaw was found in the Tomcat package of OpenSUSE and derived distributions. This issue occurs due to incorrect permissions and a race condition in the %post section of the Tomcat RPM package, resulting in local privilege escalation when the Tomcat package is re-installed.	Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root
Title	tomcat: Escalation to root from tomcat user via %post script	tomcat packaging allows for escalation to root from tomcat user
Weaknesses		CWE-732
References		https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22029
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: suse

Published: 2024-10-16T13:20:47.698Z

Updated: 2024-10-16T13:20:47.698Z

Reserved: 2024-01-04T12:38:34.023Z

Link: CVE-2024-22029

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2024-10-16T14:15:04.500

Modified: 2024-10-16T16:38:14.557

Link: CVE-2024-22029

Redhat

Severity : Moderate

Publid Date: 2024-02-14T00:00:00Z

Links: CVE-2024-22029 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22029", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2024-01-04T12:38:34.023Z", "datePublished": "2024-10-16T13:20:47.698Z", "dateUpdated": "2024-10-16T13:20:47.698Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "tomcat", "product": "Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Enterprise Storage 7.1", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise High Performance Computing 15 SP5", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise Module for Web and Scripting 15 SP5", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise Server 15 SP5", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise Server for SAP Applications 15 SP5", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise High Performance Computing 15 SP6", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise Module for Web and Scripting 15 SP6", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise Server 15 SP6", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise Server for SAP Applications 15 SP6", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise Server 15 SP2-LTSS", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise Server 15 SP3-LTSS", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise Server 15 SP4-LTSS", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise Server for SAP Applications 15 SP2", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise Server for SAP Applications 15 SP3", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Linux Enterprise Server for SAP Applications 15 SP4", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "SUSE Manager Server 4.3", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "openSUSE Leap 15.5", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-150200.57.1", "status": "affected", "version": "?", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "tomcat", "product": "openSUSE Tumbleweed", "vendor": "SUSE", "versions": [{"lessThan": "9.0.85-3.1", "status": "affected", "version": "?", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Johannes Segitz of SUSE"}], "datePublic": "2024-02-14T14:59:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root<br><div><br></div><div><br></div>"}], "value": "Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2024-10-16T13:20:47.698Z"}, "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22029"}], "source": {"discovery": "INTERNAL"}, "title": "tomcat packaging allows for escalation to root from tomcat user", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}}}