CVE-2022-29885

Description

The documentation of Apache Tomcat 10.1.0 to 10.1.0, 10.0.0 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

How to fix CVE-2022-29885

To remediate CVE-2022-29885, upgrade the affected package to a fixed version below.

• —upgrade to 8.5.79 or later
• —upgrade to 9.0.43-2~deb11u4 or later
• —upgrade to 10.1.0-M15 or later

Is CVE-2022-29885 being exploited?

Likely — EPSS is 73.1%, placing CVE-2022-29885 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (3)

• >= 8.5.38, < 8.5.79, >= 9.0.13, < 9.0.63, >= 10.0.0, < 10.0.21
• from 0, < 9.0.43-2~deb11u4
• >= 10.1.0-M1, < 10.1.0-M15

CVSS scores

References (14)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-29885
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-29885
• PATCHgithub.com/apache/tomcat
• WEBpacketstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html