p PatchFirst

CVE-2022-29885

CVE-2022-29885 · EncryptInterceptor does not provide complete protection on insecure networks

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

CVSS 7.5 · High · EPSS 73.5% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache tomcat

    Versions
    • Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14: Affected
    • Apache Tomcat 10 10.0.0-M1 to 10.0.20: Affected
    • Apache Tomcat 9 9.0.13 to 9.0.62: Affected
    • Apache Tomcat 8.5 8.5.38 to 8.5.78: Affected

    No fix published

  • tomcat9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.0.63-1

    Update to 9.0.63-1

  • tomcat9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.0.63-1

    Update to 9.0.63-1

  • tomcat9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.0.63-1

    Update to 9.0.63-1

  • tomcat8 Ubuntu:Pro:18.04:LTS

    Versions
    • 8.5.21-1ubuntu1
    • 8.5.29-1
    • 8.5.30-1
    • 8.5.30-1ubuntu1
    • 8.5.30-1ubuntu1.2
    • 8.5.30-1ubuntu1.3
    • 8.5.30-1ubuntu1.4
    • 8.5.39-1ubuntu1~18.04.1
    • 8.5.39-1ubuntu1~18.04.2
    • 8.5.39-1ubuntu1~18.04.3
    • 8.5.39-1ubuntu1~18.04.3+esm1
    Affected ranges
    • ECOSYSTEM: < 8.5.39-1ubuntu1~18.04.3+esm2

    Update to 8.5.39-1ubuntu1~18.04.3+esm2

  • tomcat9 Ubuntu:Pro:18.04:LTS

    Versions
    • 9.0.16-3~18.04.1
    • 9.0.16-3ubuntu0.18.04.1
    • 9.0.16-3ubuntu0.18.04.2
    • 9.0.16-3ubuntu0.18.04.2+esm1
    Affected ranges
    • ECOSYSTEM: < 9.0.16-3ubuntu0.18.04.2+esm2

    Update to 9.0.16-3ubuntu0.18.04.2+esm2

  • tomcat9 Ubuntu:20.04:LTS

    Versions
    • 9.0.24-1
    • 9.0.27-1
    • 9.0.31-1
    • 9.0.31-1ubuntu0.1
    • 9.0.31-1ubuntu0.2
    • 9.0.31-1ubuntu0.3
    • 9.0.31-1ubuntu0.4
    • 9.0.31-1ubuntu0.5
    Affected ranges
    • ECOSYSTEM: < 9.0.31-1ubuntu0.6

    Update to 9.0.31-1ubuntu0.6

  • tomcat9 Ubuntu:Pro:22.04:LTS

    Versions
    • 9.0.43-3
    • 9.0.54-1
    • 9.0.55-1
    • 9.0.58-1
    • 9.0.58-1ubuntu0.1
    • 9.0.58-1ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: < 9.0.58-1ubuntu0.1+esm2

    Update to 9.0.58-1ubuntu0.1+esm2

Original sources

Check your server →