Local User Escalation via Insecure Packaging
CVE-2024-22029
7.8HIGH
Key Information:
What is CVE-2024-22029?
The vulnerability arises from insecure permissions associated with the packaging of Tomcat, a web server and servlet container. This flaw allows local users to exploit a race condition during the installation process, potentially leading to privilege escalation to root. Organizations employing Tomcat should take immediate precautions to secure their environments against unauthorized privilege escalations by reviewing the implementation and applying any necessary patches or mitigations.
Affected Version(s)
Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122 ? < 9.0.85-150200.57.1
openSUSE Leap 15.5 ? < 9.0.85-150200.57.1
openSUSE Tumbleweed ? < 9.0.85-3.1