EncryptInterceptor does not provide complete protection on insecure networks
Summary
| CVE | CVE-2022-29885 |
|---|---|
| State | PUBLISHED |
| Assigner | apache |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-05-12 08:15:07 UTC |
| Updated | 2026-10-08 22:17:20 UTC |
| Description | The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.734740000 probability, percentile 0.994650000 (date 2026-10-20)
Problem Types: CWE-400 | NVD-CWE-noinfo | CWE-400 CWE-400 Uncontrolled Resource Consumption
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 2.0 | [email protected] | Primary | 5 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
NoneAvailability
PartialAV:N/AC:L/Au:N/C:N/I:N/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Tomcat | 10.1.0 | milestone1 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone10 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone11 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone12 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone13 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone14 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone2 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone3 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone4 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone5 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone6 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone7 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone8 | All | All |
| Application | Apache | Tomcat | 10.1.0 | milestone9 | All | All |
| Application | Apache | Tomcat | All | All | All | All |
| Application | Apache | Tomcat | All | All | All | All |
| Application | Apache | Tomcat | All | All | All | All |
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 11.0 | All | All | All |
| Application | Oracle | Hospitality Cruise Shipboard Property Management System | 20.2.1 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Apache Software Foundation | Apache Tomcat | affected Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14 | Not specified |
| CNA | Apache Software Foundation | Apache Tomcat | affected Apache Tomcat 10 10.0.0-M1 to 10.0.20 | Not specified |
| CNA | Apache Software Foundation | Apache Tomcat | affected Apache Tomcat 9 9.0.13 to 9.0.62 | Not specified |
| CNA | Apache Software Foundation | Apache Tomcat | affected Apache Tomcat 8.5 8.5.38 to 8.5.78 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv | af854a3a-2127-422b-91ae-364da2661108 | lists.apache.org | Mailing List, Mitigation, Vendor Advisory |
| Debian -- Security Information -- DSA-5265-1 tomcat9 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Third Party Advisory |
| Oracle Critical Patch Update Advisory - July 2022 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | Patch, Third Party Advisory |
| Apache Tomcat 10.1 Denial Of Service ≈ Packet Storm | af854a3a-2127-422b-91ae-364da2661108 | packetstormsecurity.com | |
| [SECURITY] [DLA 3160-1] tomcat9 security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | Mailing List, Third Party Advisory |
| CVE-2022-29885 Apache Tomcat Vulnerability in NetApp Products | NetApp Product Security | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This issue was reported to the Apache Tomcat Security team by 4ra1n. (en)
Legacy QID Mappings
- 150531 Apache Tomcat EncryptInterceptor DoS Vulnerability (CVE-2022-29885)
- 181163 Debian Security Update for tomcat9 (DLA 3160-1)
- 181177 Debian Security Update for tomcat9 (DSA 5265-1)
- 182695 Debian Security Update for tomcat9 (CVE-2022-29885)
- 296084 Oracle Solaris 11.4 Support Repository Update (SRU) 50.126.3 Missing (CPUOCT2022)
- 354037 Amazon Linux Security Advisory for tomcat8 : ALAS-2022-1627
- 356303 Amazon Linux Security Advisory for tomcat : ALASTOMCAT8.5-2023-005
- 730503 Apache Tomcat Denial of Service (DoS) Vulnerability (CVE-2022-29885)