7.5

CVE-2022-29885

EncryptInterceptor does not provide complete protection on insecure networks

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Tomcat Version >= 8.5.38 <= 8.5.78
Apache ≫ Tomcat Version >= 9.0.13 <= 9.0.62
Apache ≫ Tomcat Version >= 10.0.0 <= 10.0.20
Apache ≫ Tomcat Version10.1.0 Updatemilestone1
Apache ≫ Tomcat Version10.1.0 Updatemilestone10
Apache ≫ Tomcat Version10.1.0 Updatemilestone11
Apache ≫ Tomcat Version10.1.0 Updatemilestone12
Apache ≫ Tomcat Version10.1.0 Updatemilestone13
Apache ≫ Tomcat Version10.1.0 Updatemilestone14
Apache ≫ Tomcat Version10.1.0 Updatemilestone2
Apache ≫ Tomcat Version10.1.0 Updatemilestone3
Apache ≫ Tomcat Version10.1.0 Updatemilestone4
Apache ≫ Tomcat Version10.1.0 Updatemilestone5
Apache ≫ Tomcat Version10.1.0 Updatemilestone6
Apache ≫ Tomcat Version10.1.0 Updatemilestone7
Apache ≫ Tomcat Version10.1.0 Updatemilestone8
Apache ≫ Tomcat Version10.1.0 Updatemilestone9
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version11.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 73.14% 0.994
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

https://www.oracle.com/security-alerts/cpujul2022.html
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html
Third Party Advisory
Mailing List
https://www.debian.org/security/2022/dsa-5265
Third Party Advisory
http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html
https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv
Vendor Advisory
Mailing List
Mitigation
https://security.netapp.com/advisory/ntap-20220629-0002/
Third Party Advisory