Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2022-29885 BIT-tomcat-2022-29885EUVD-2022-5128GHSA-r84p-88g2-2vx2

EncryptInterceptor does not provide complete protection on insecure networks

Published May 12, 2022 · Updated Oct 8, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat Package: tomcat8 Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14, Apache Tomcat 10 10.0.0-M1 to 10.0.20, Apache Tomcat 9 9.0.13 to 9.0.62, Apache Tomcat 8.5 8.5.38 to 8.5.78 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat9 9.0.63-1 —
Debian 13 tomcat9 9.0.63-1 —
Debian 12 tomcat9 9.0.63-1 —
Debian 11 tomcat9 9.0.43-2~deb11u4 DSA-5265-1
Debian 10 tomcat9 9.0.31-1~deb10u7 DLA-3160-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS tomcat9 9.0.31-1ubuntu0.6 USN-6943-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS tomcat9 9.0.58-1ubuntu0.1+esm2 USN-6943-1
Ubuntu Pro 18.04 LTS tomcat8 8.5.39-1ubuntu1~18.04.3+esm2 USN-6943-1
Ubuntu Pro 18.04 LTS tomcat9 9.0.16-3ubuntu0.18.04.2+esm2 USN-6943-1
Ubuntu Pro 16.04 LTS tomcat8 8.0.32-1ubuntu1.13+esm1 USN-6943-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat >= 10.1.0-M1, < 10.1.0-M15 10.1.0-M15 GHSA-r84p-88g2-2vx2
Maven org.apache.tomcat:tomcat >= 10.0.0-M1, < 10.0.21 10.0.21 GHSA-r84p-88g2-2vx2
Maven org.apache.tomcat:tomcat >= 9.0.13, < 9.0.63 9.0.63 GHSA-r84p-88g2-2vx2
Maven org.apache.tomcat:tomcat >= 8.5.38, < 8.5.79 8.5.79 GHSA-r84p-88g2-2vx2

Advisories 5

References