UBUNTU-CVE-2022-29885

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2022-29885

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-29885.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2022-29885

Related

Published

2022-05-12T08:15:00Z

Modified

2022-05-12T08:15:00Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

References

Affected packages

Ubuntu:Pro:18.04:LTS / tomcat8

Package

Name: tomcat8
Purl: pkg:deb/ubuntu/tomcat8@8.5.39-1ubuntu1~18.04.3+esm2?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.5.39-1ubuntu1~18.04.3+esm2

Affected versions

8.*

8.5.21-1ubuntu1

8.5.29-1

8.5.30-1

8.5.30-1ubuntu1

8.5.30-1ubuntu1.2

8.5.30-1ubuntu1.3

8.5.30-1ubuntu1.4

8.5.39-1ubuntu1~18.04.1

8.5.39-1ubuntu1~18.04.2

8.5.39-1ubuntu1~18.04.3

8.5.39-1ubuntu1~18.04.3+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "tomcat8-common": "8.5.39-1ubuntu1~18.04.3+esm2",
            "tomcat8-admin": "8.5.39-1ubuntu1~18.04.3+esm2",
            "tomcat8-user": "8.5.39-1ubuntu1~18.04.3+esm2",
            "libtomcat8-java": "8.5.39-1ubuntu1~18.04.3+esm2",
            "tomcat8": "8.5.39-1ubuntu1~18.04.3+esm2",
            "tomcat8-examples": "8.5.39-1ubuntu1~18.04.3+esm2",
            "libtomcat8-embed-java": "8.5.39-1ubuntu1~18.04.3+esm2",
            "tomcat8-docs": "8.5.39-1ubuntu1~18.04.3+esm2"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / tomcat9

Package

Name: tomcat9
Purl: pkg:deb/ubuntu/tomcat9@9.0.16-3ubuntu0.18.04.2+esm2?arch=src?distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.0.16-3ubuntu0.18.04.2+esm2

Affected versions

9.*

9.0.16-3~18.04.1

9.0.16-3ubuntu0.18.04.1

9.0.16-3ubuntu0.18.04.2

9.0.16-3ubuntu0.18.04.2+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "tomcat9": "9.0.16-3ubuntu0.18.04.2+esm2",
            "tomcat9-user": "9.0.16-3ubuntu0.18.04.2+esm2",
            "libtomcat9-embed-java": "9.0.16-3ubuntu0.18.04.2+esm2",
            "tomcat9-docs": "9.0.16-3ubuntu0.18.04.2+esm2",
            "libtomcat9-java": "9.0.16-3ubuntu0.18.04.2+esm2",
            "tomcat9-examples": "9.0.16-3ubuntu0.18.04.2+esm2",
            "tomcat9-common": "9.0.16-3ubuntu0.18.04.2+esm2",
            "tomcat9-admin": "9.0.16-3ubuntu0.18.04.2+esm2"
        }
    ]
}

Ubuntu:20.04:LTS / tomcat9

Package

Name: tomcat9
Purl: pkg:deb/ubuntu/tomcat9@9.0.31-1ubuntu0.6?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.0.31-1ubuntu0.6

Affected versions

9.*

9.0.24-1

9.0.27-1

9.0.31-1

9.0.31-1ubuntu0.1

9.0.31-1ubuntu0.2

9.0.31-1ubuntu0.3

9.0.31-1ubuntu0.4

9.0.31-1ubuntu0.5

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "tomcat9": "9.0.31-1ubuntu0.6",
            "tomcat9-user": "9.0.31-1ubuntu0.6",
            "libtomcat9-embed-java": "9.0.31-1ubuntu0.6",
            "tomcat9-docs": "9.0.31-1ubuntu0.6",
            "libtomcat9-java": "9.0.31-1ubuntu0.6",
            "tomcat9-examples": "9.0.31-1ubuntu0.6",
            "tomcat9-common": "9.0.31-1ubuntu0.6",
            "tomcat9-admin": "9.0.31-1ubuntu0.6"
        }
    ]
}

Ubuntu:22.04:LTS / tomcat9

Package

Name: tomcat9

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.0.43-3

9.0.54-1

9.0.55-1

9.0.58-1

9.0.58-1ubuntu0.1

Ecosystem specific

{
    "ubuntu_priority": "low"
}

Ubuntu:Pro:22.04:LTS / tomcat9

Package

Name: tomcat9
Purl: pkg:deb/ubuntu/tomcat9@9.0.58-1ubuntu0.1+esm2?arch=src?distro=esm-apps/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.0.58-1ubuntu0.1+esm2

Affected versions

9.*

9.0.43-3

9.0.54-1

9.0.55-1

9.0.58-1

9.0.58-1ubuntu0.1

9.0.58-1ubuntu0.1+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "tomcat9": "9.0.58-1ubuntu0.1+esm2",
            "tomcat9-user": "9.0.58-1ubuntu0.1+esm2",
            "libtomcat9-embed-java": "9.0.58-1ubuntu0.1+esm2",
            "tomcat9-docs": "9.0.58-1ubuntu0.1+esm2",
            "libtomcat9-java": "9.0.58-1ubuntu0.1+esm2",
            "tomcat9-examples": "9.0.58-1ubuntu0.1+esm2",
            "tomcat9-common": "9.0.58-1ubuntu0.1+esm2",
            "tomcat9-admin": "9.0.58-1ubuntu0.1+esm2"
        }
    ]
}