Description
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat8.5.38 – 8.5.78
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat10.1.0 – 10.1.0
- apache / Tomcat10.1.0 – 10.1.0
- Apache Software Foundation / Apache TomcatApache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14 – Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14
- Apache Software Foundation / Apache TomcatApache Tomcat 10 10.0.0-M1 to 10.0.20 – Apache Tomcat 10 10.0.0-M1 to 10.0.20
- Apache Software Foundation / Apache TomcatApache Tomcat 9 9.0.13 to 9.0.62 – Apache Tomcat 9 9.0.13 to 9.0.62
- Apache Software Foundation / Apache TomcatApache Tomcat 8.5 8.5.38 to 8.5.78 – Apache Tomcat 8.5 8.5.38 to 8.5.78
- Debian / debian_linux10.0 – 10.0
- Debian / debian_linux11.0 – 11.0
- oracle / hospitality_cruise_shipboard_property_management_system20.2.1 – 20.2.1
Exploits & proofs of concept
- exploit-dbApache Tomcat 10.1 - Denial Of Serviceby Cristian Giustini
References
- MAILING_LISThttps://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv
- VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujul2022.html
- MISChttps://security.netapp.com/advisory/ntap-20220629-0002/
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2022/10/msg00029.html
- VENDOR_ADVISORYhttps://www.debian.org/security/2022/dsa-5265
- EXPLOIThttp://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html
Updated 9m ago · 8 sources