BIT-tomcat-2022-29885

2024-03-0611:09:24

Google

osv.dev

apache tomcat

version 10.1.0-m1

version 10.1.0-m14

version 10.0.0-m1

version 10.0.20

version 9.0.13

version 9.0.62

version 8.5.38

version 8.5.78

encryptinterceptor

misrepresentation

network risks

dos

0.03 Low

EPSS

Percentile

90.9%

JSON

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

CPENameOperatorVersion
tomcatle10.1.0-milestone5
tomcatge8.5.38
tomcatge10.1.0-milestone10
tomcatle10.1.0-milestone11
tomcatge10.1.0-milestone13
tomcatle10.1.0-milestone3
tomcatle10.1.0-milestone12
tomcatge10.1.0-milestone1
tomcatlt9.0.62
tomcatle10.1.0-milestone9

Name	Operator	Version
tomcat	le	10.1.0-milestone5
tomcat	ge	8.5.38
tomcat	ge	10.1.0-milestone10
tomcat	le	10.1.0-milestone11
tomcat	ge	10.1.0-milestone13
tomcat	le	10.1.0-milestone3
tomcat	le	10.1.0-milestone12
tomcat	ge	10.1.0-milestone1
tomcat	lt	9.0.62
tomcat	le	10.1.0-milestone9