CVE-2022-29885

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

• CWE-400

• http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html
• https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcvMailing List, Mitigation, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/10/msg00029.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220629-0002/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5265Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
• http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html
• https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcvMailing List, Mitigation, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2022/10/msg00029.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220629-0002/Third Party Advisory
• https://www.debian.org/security/2022/dsa-5265Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Published

May 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2988A CWE-787: Out-of-bounds Write vulnerability exists that cou…7.5
• CVE-2022-29880A vulnerability has been identified in SICAM T (All versions…6.5
• CVE-2022-29881A vulnerability has been identified in SICAM T (All versions…6.9
• CVE-2022-29882A vulnerability has been identified in SICAM T (All versions…7.1
• CVE-2022-29883A vulnerability has been identified in SICAM T (All versions…6.9
• CVE-2022-29884A vulnerability has been identified in CP-8000 MASTER MODULE…7.5
• CVE-2022-29886An integer overflow vulnerability exists in the way ESTsoft …7.8
• CVE-2022-29887Cross-site Scripting (XSS) in some Intel(R) Manageability Co…9.6
• CVE-2022-29888A leftover debug code vulnerability exists in the httpd port…8.1
• CVE-2022-29889A hard-coded password vulnerability exists in the telnet fun…9.8
• CVE-2022-2989An incorrect handling of the supplementary groups in the Pod…7.1
• CVE-2022-29890In affected versions of Octopus Server the help sidebar can …6.1