CVE-2022-29885

HIGH7.5

EncryptInterceptor does not provide complete protection on insecure networks

Published May 12, 2022

Modified 1 years ago

Details

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

References

WEB

http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html

WEB

https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv

WEB

https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html

WEB

https://security.netapp.com/advisory/ntap-20220629-0002/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2022-29885

ADVISORY