EncryptInterceptor does not provide complete protection on insecure networks (Apache Software Foundation Apache Tomcat)
At a glance
- Source
- NVD
- EPSS
- EPSS 73.47 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
Weaknesses (CWE)
- CWE-400 — Uncontrolled Resource Consumption
References
- https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20220629-0002/
- https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html
- https://www.debian.org/security/2022/dsa-5265
- http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-r84p-88g2-2vx2 — Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption
European references
- ENISA EUVD · EUVD-2022-5128
- GCVE · GCVE-0-2022-29885
CERT-FR advisories
- CERTFR-2024-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0240 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2022-AVI-952 — Multiples vulnérabilités dans IBM QRadar · cert.ssi.gouv.fr
- CERTFR-2022-AVI-654 — Multiples vulnérabilités dans Oracle Database Server · cert.ssi.gouv.fr
- CERTFR-2022-AVI-443 — Vulnérabilité dans Apache Tomcat · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 8.5.38 ≤ 8.5.78cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 9.0.13 ≤ 9.0.62cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*≥ 10.0.0 ≤ 10.0.20cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.2.1:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache Tomcat | affected Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14 ; affected Apache Tomcat 10 10.0.0-M1 to 10.0.20 ; affected Apache Tomcat 9 9.0.13 to 9.0.62 ; affected Apache Tomcat 8.5 8.5.38 to 8.5.78 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |