GHSA-r84p-88g2-2vx2
Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption
At a glance
- Published
- Updated
- CVE
- CVE-2022-29885
- Aliases
- BIT-tomcat-2022-29885
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat:tomcat | introduced 10.1.0-M1, fixed 10.1.0-M15 |
| Maven · org.apache.tomcat:tomcat | introduced 10.0.0-M1, fixed 10.0.21 |
| Maven · org.apache.tomcat:tomcat | introduced 9.0.13, fixed 9.0.63 |
| Maven · org.apache.tomcat:tomcat | introduced 8.5.38, fixed 8.5.79 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-29885 ADVISORY
- https://github.com/apache/tomcat/commit/0fa7721f11d565a2cd2e44366c388ad6a3e6357d WEB
- https://github.com/apache/tomcat/commit/36826ea638457d7e17876a70f89cb435b6db0d91 WEB
- https://github.com/apache/tomcat/commit/b679bc627f5a4ea6510af95adfb7476b07eba890 WEB
- https://github.com/apache/tomcat/commit/eaafd28296c54d983e28a47953c1f5cb2c334f48 WEB
- https://github.com/apache/tomcat PACKAGE
- https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv WEB
- https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html WEB
- https://security.netapp.com/advisory/ntap-20220629-0002 WEB
- https://www.debian.org/security/2022/dsa-5265 WEB
- https://www.oracle.com/security-alerts/cpujul2022.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |