CVE-2022-29885: Apache Tomcat EncryptInterceptor Documentation Misrepresentation
Summary
CVE-2022-29885: EncryptInterceptor does not provide complete protection on insecure networks. Affects tomcat across 17 version ranges.
>= 8.5.38, < 8.5.79
>= 9.0.13, < 9.0.63
>= 10.0.0, < 10.0.21
>= 10.1.0-milestone1, < 10.1.0
>= 10.1.0-milestone2, < 10.1.0
>= 10.1.0-milestone3, < 10.1.0
>= 10.1.0-milestone4, < 10.1.0
>= 10.1.0-milestone5, < 10.1.0
>= 10.1.0-milestone6, < 10.1.0
>= 10.1.0-milestone7, < 10.1.0
>= 10.1.0-milestone8, < 10.1.0
>= 10.1.0-milestone9, < 10.1.0
>= 10.1.0-milestone10, < 10.1.0
>= 10.1.0-milestone11, < 10.1.0
>= 10.1.0-milestone12, < 10.1.0
>= 10.1.0-milestone13, < 10.1.0
>= 10.1.0-milestone14, < 10.1.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- org.apache.tomcat:tomcat · Maven
- tomcat9 · Debian:11
The same CVE-2022-29885 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. The EncryptInterceptor is a component in Apache Tomcat that offers confidentiality and integrity protection. However, the documentation for versions 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62, and 8.5.38 to 8.5.78 incorrectly stated that it enabled Tomcat clustering to run over an untrusted network. This misrepresentation could lead to misunderstandings and misconfigurations in the deployment of Apache Tomcat.
Vulnerability Detail
The misrepresentation in the EncryptInterceptor documentation could result in the incorrect belief that it provides protection against all risks associated with running over any untrusted network, including denial-of-service (DoS) risks. While the EncryptInterceptor does offer confidentiality and integrity protection, it does not address all potential security concerns when running Apache Tomcat over an untrusted network. This vulnerability could lead to misconfigurations and inadequate security measures, potentially exposing the application to DoS attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.5.38, < 8.5.798.5.79 -
>= 9.0.13, < 9.0.639.0.63 -
>= 10.0.0, < 10.0.2110.0.21 -
>= 10.1.0-milestone1, < 10.1.010.1.0 -
>= 10.1.0-milestone2, < 10.1.010.1.0 -
>= 10.1.0-milestone3, < 10.1.010.1.0
Show all 17 release lines
-
>= 10.1.0-milestone4, < 10.1.010.1.0 -
>= 10.1.0-milestone5, < 10.1.010.1.0 -
>= 10.1.0-milestone6, < 10.1.010.1.0 -
>= 10.1.0-milestone7, < 10.1.010.1.0 -
>= 10.1.0-milestone8, < 10.1.010.1.0 -
>= 10.1.0-milestone9, < 10.1.010.1.0 -
>= 10.1.0-milestone10, < 10.1.010.1.0 -
>= 10.1.0-milestone11, < 10.1.010.1.0 -
>= 10.1.0-milestone12, < 10.1.010.1.0 -
>= 10.1.0-milestone13, < 10.1.010.1.0 -
>= 10.1.0-milestone14, < 10.1.010.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround for this vulnerability. However, it is crucial to review and update the documentation and configuration of Apache Tomcat to ensure that it aligns with the actual capabilities of the EncryptInterceptor. Additionally, implementing other security measures, such as network segmentation and access controls, can help mitigate the risks associated with running Apache Tomcat over untrusted networks.
Conclusion
The misrepresentation in the EncryptInterceptor documentation of Apache Tomcat versions 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62, and 8.5.38 to 8.5.78 could lead to misconfigurations and inadequate security measures. It is crucial to update Apache Tomcat to a version that includes the corrected documentation and review the configuration to ensure it aligns with the actual capabilities of the EncryptInterceptor. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that provides a platform for running Java-based web applications.
The EncryptInterceptor is a component in Apache Tomcat that offers confidentiality and integrity protection for network communications.
The misrepresentation in the EncryptInterceptor documentation could lead to misconfigurations and inadequate security measures, potentially exposing the application to denial-of-service (DoS) attacks.
To fix this vulnerability, update Apache Tomcat to a version that includes the corrected documentation.
There are no specific workarounds for this vulnerability. However, reviewing and updating the documentation and configuration of Apache Tomcat can help mitigate the risks.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
