CVEvulnerability

CVE-2022-29885

7.5 HIGH Published 2022-05-12 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2022-05-12
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-400

Description

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

Affected configurations

• apache tomcat (>= 8.5.38 <= 8.5.78) • apache tomcat (>= 9.0.13 <= 9.0.62) • apache tomcat (>= 10.0.0 <= 10.0.20) • apache tomcat 10.1.0 • debian debian linux 10.0 • debian debian linux 11.0 • oracle hospitality cruise shipboard property management system 20.2.1

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References