7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.03 Low
EPSS
Percentile
90.8%
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
github.com/apache/tomcat
github.com/apache/tomcat/commit/0fa7721f11d565a2cd2e44366c388ad6a3e6357d
github.com/apache/tomcat/commit/36826ea638457d7e17876a70f89cb435b6db0d91
github.com/apache/tomcat/commit/b679bc627f5a4ea6510af95adfb7476b07eba890
github.com/apache/tomcat/commit/eaafd28296c54d983e28a47953c1f5cb2c334f48
lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv
lists.debian.org/debian-lts-announce/2022/10/msg00029.html
nvd.nist.gov/vuln/detail/CVE-2022-29885
security.netapp.com/advisory/ntap-20220629-0002
www.debian.org/security/2022/dsa-5265
www.oracle.com/security-alerts/cpujul2022.html
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.03 Low
EPSS
Percentile
90.8%