{"id":"CVE-2024-22029","aliases":["EUVD-2024-19635","GHSA-w8vw-x82m-vg68","SUSE-SU-2024:0472-1","SUSE-SU-2024:0473-1","openSUSE-SU-2024:13692-1","openSUSE-SU-2024:13693-1"],"status":"published","title":"tomcat packaging allows for escalation to root from tomcat user","description":"Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00182,"percentile":0.0785,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2024-02-14T14:02:00Z","modified":"2026-06-17T07:10:34Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"tomcat10","fixed_in":["10.1.18-150200.5.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"tomcat10","fixed_in":["10.1.18-150200.5.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tomcat","fixed_in":["9.0.85-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","fixed_in":["10.1.18-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.18-150200.5.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.18-150200.5.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.18-3.1"}]}]}],"products":[{"vendor":"suse","product":"container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122"},{"vendor":"suse","product":"opensuse leap 15.5"},{"vendor":"suse","product":"opensuse tumbleweed"},{"vendor":"suse","product":"suse enterprise storage 7.1"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp2-ltss"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp3-ltss"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp4-espos"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp4-ltss"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp5"},{"vendor":"suse","product":"suse linux enterprise high performance computing 15 sp6"},{"vendor":"suse","product":"suse linux enterprise module for web and scripting 15 sp5"},{"vendor":"suse","product":"suse linux enterprise module for web and scripting 15 sp6"},{"vendor":"suse","product":"suse linux enterprise server 15 sp2-ltss"},{"vendor":"suse","product":"suse linux enterprise server 15 sp3-ltss"},{"vendor":"suse","product":"suse linux enterprise server 15 sp4-ltss"},{"vendor":"suse","product":"suse linux enterprise server 15 sp5"},{"vendor":"suse","product":"suse linux enterprise server 15 sp6"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp2"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp3"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp4"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp5"},{"vendor":"suse","product":"suse linux enterprise server for sap applications 15 sp6"},{"vendor":"suse","product":"suse manager server 4.3"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22029"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22029"},{"url":"https://github.com/advisories/GHSA-w8vw-x82m-vg68"},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240472-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216118","tags":["report"]},{"url":"https://bugzilla.suse.com/1216119","tags":["report"]},{"url":"https://bugzilla.suse.com/1216120","tags":["report"]},{"url":"https://bugzilla.suse.com/1217402","tags":["report"]},{"url":"https://bugzilla.suse.com/1217649","tags":["report"]},{"url":"https://bugzilla.suse.com/1217768","tags":["report"]},{"url":"https://bugzilla.suse.com/1219208","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22029","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240473-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-22029","title":"tomcat packaging allows for escalation to root from tomcat user","description":"Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root","status":"published","published":"2024-10-16T13:20:47.698Z","modified":"2025-08-26T20:18:11.916Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:34:00.254134Z"}],"euvd":[{"id":"EUVD-2024-19635","description":"Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root","status":"published","published":"2024-10-16T13:20:47Z","modified":"2025-08-26T20:18:11Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:31:52.651465Z"}],"ghsa":[{"id":"GHSA-w8vw-x82m-vg68","title":"Insecure permissions in the packaging of tomcat allow local users that win a race during package...","description":"Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root","status":"published","published":"2024-10-16T15:32:07Z","modified":"2024-10-16T15:32:13Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:58:31.476115Z"}],"nvd":[{"id":"CVE-2024-22029","description":"Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root","status":"published","published":"2024-10-16T14:15:04.5Z","modified":"2026-06-17T07:10:34.363Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:10:32.45889Z"}],"osv":[{"id":"openSUSE-SU-2024:13692-1","title":"tomcat-9.0.85-3.1 on GA media","description":"These are all security issues fixed in the tomcat-9.0.85-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:17:44.203263Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13693-1","title":"tomcat10-10.1.18-3.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.18-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:37:12.802732Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:0472-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nUpdated to Tomcat 9.0.85:\n\n- CVE-2023-45648: Improve trailer header parsing (bsc#1216118).\n- CVE-2023-42794: FileUpload: remove tmp files to avoid DoS on Windows (bsc#1216120).\n- CVE-2023-42795: Improve handling of failures during recycle() methods (bsc#1216119).\n- CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing (bsc#1217649)\n- CVE-2024-22029: Fixed escalation to root from tomcat user via %post script. (bsc#1219208)\n    \nThe following non-security issues were fixed:\n\n- Fixed the file permissions for server.xml (bsc#1217768, bsc#1217402).\n\nFind the full release notes at:\n\nhttps://tomcat.apache.org/tomcat-9.0-doc/changelog.html\n","status":"published","published":"2024-02-14T14:02:00Z","modified":"2026-02-04T03:56:15.926664Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0473-1","title":"Security update for tomcat10","description":"This update for tomcat10 fixes the following issues:\n\n- CVE-2024-22029: Fixed escalation to root from tomcat user via %post script. (bsc#1219208)\n","status":"published","published":"2024-02-14T14:02:44Z","modified":"2026-02-04T04:01:13.887538Z","updated_at":"2026-11-02T15:53:54.239786Z"}]}}