Threat Investigation
Request a demo

CVE-2024-22029

High

Description

Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root

SeverityHigh
CVSS7.8
Exploit probability—
ProductContainer suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122
PublishedOct 16, 2024
First seenOct 16, 2024
Weakness typeCWE-732CWE-732

How to fix

Update
  • SUSE Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.1229.0.85-150200.57.1 or later
  • SUSE SUSE Enterprise Storage 7.19.0.85-150200.57.1 or later
  • SUSE SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS9.0.85-150200.57.1 or later
  • SUSE SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS9.0.85-150200.57.1 or later
  • SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS9.0.85-150200.57.1 or later
  • SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS9.0.85-150200.57.1 or later
  • SUSE SUSE Linux Enterprise High Performance Computing 15 SP59.0.85-150200.57.1 or later
  • SUSE SUSE Linux Enterprise Module for Web and Scripting 15 SP59.0.85-150200.57.1 or later
  • SUSE SUSE Linux Enterprise Server 15 SP59.0.85-150200.57.1 or later
  • SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP59.0.85-150200.57.1 or later
  • SUSE SUSE Linux Enterprise High Performance Computing 15 SP69.0.85-150200.57.1 or later
  • SUSE SUSE Linux Enterprise Module for Web and Scripting 15 SP69.0.85-150200.57.1 or later

Affected products

ProductAffected versionsFixed in
SUSE Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Enterprise Storage 7.1? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP5? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise Module for Web and Scripting 15 SP5? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server 15 SP5? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP5? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP6? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise Module for Web and Scripting 15 SP6? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server 15 SP6? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP6? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server 15 SP2-LTSS? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server 15 SP3-LTSS? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server 15 SP4-LTSS? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP2? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP3? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP4? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE SUSE Manager Server 4.3? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE openSUSE Leap 15.5? ≤ v < 9.0.85-150200.57.19.0.85-150200.57.1
SUSE openSUSE Tumbleweed? ≤ v < 9.0.85-3.19.0.85-3.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.