CVE-2024-56337

The vulnerability is marked as moderate rather than important due to the specific conditions required for exploitation. For the attack to succeed, the server must be running on a case-insensitive file system (e.g., Windows or macOS) and have the default servlet enabled with write permissions —a configuration that is not common in production-grade environments. Additionally, the attacker must gain the ability to upload files to a writable directory and exploit a race condition to execute them as JSP files, which introduces a level of complexity and timing dependency.

The pki-servlet-engine package has been obsoleted by the tomcat package as of Red Hat Enterprise Linux 8.9 so no fixes for the servlet engine would be made available.

Although Red Hat Satellite Server— via its Candlepin component— employs the use of Tomcat, Satellite is itself not considered Affected. Satellite does not provide the Tomcat package— it is inherited from the underlying RHEL Operating System. Users of Red Hat Satellite are advised to refer to the impact state of the Tomcat package provided by the version of RHEL underpinning the Satellite Server instance, as any errata will be provided via RHEL Application Stream repositories.

It should be noted that a successful attack requires the server be running on a case-insensitive file system. As Satellite only runs on RHEL— and RHEL employs case-sensitive filesystems by default— a typical Satellite server instance is not vulnerable. Additionally, a successful attack also requires the server have the default servlet enabled with write permissions– a condition which does not exist in a default Satellite deployment. Again, a typical Satellite server instance is not vulnerable.