The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
Fix
Public exploits 3
- Apache Tomcat 10.1 - Denial Of Service (dos · multiple) Exploit-DB · 2023-04-05
- iveresk/CVE-2022-29885 PoC on GitHub
- quynhlab/CVE-2022-29885 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 4
- https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv Mailing List, Mitigation, Vendor Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv Mailing List, Mitigation, Vendor Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · apache, debian, oracleNVD modified 2026-10-08 22:17
Affected (CPE criteria) 18
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management_system:20.2.1:*:*:*:*:*:*:*
References 12
- http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html
- https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv Mailing List, Mitigation, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220629-0002/ Third Party Advisory
- https://www.debian.org/security/2022/dsa-5265 Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html
- https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv Mailing List, Mitigation, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220629-0002/ Third Party Advisory
- https://www.debian.org/security/2022/dsa-5265 Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory