Disclosure summary
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
Source-reported weakness categories
CWE-400, NVD-CWE-noinfo
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2022-29885
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| apache | tomcat | * {"versionStartIncluding":"10.0.0","versionEndIncluding":"10.0.20"} |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| apache | tomcat | 10.1.0 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
| oracle | hospitality_cruise_shipboard_property_management_system | 20.2.1 |
Original records & references
- NIST NVD record
- CVE Program record
- lists.apache.org — Mailing List, Mitigation, Vendor Advisory
- lists.debian.org — Mailing List, Third Party Advisory
- security.netapp.com — Third Party Advisory
- www.debian.org — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
- lists.apache.org — Mailing List, Mitigation, Vendor Advisory
- lists.debian.org — Mailing List, Third Party Advisory
- security.netapp.com — Third Party Advisory
- www.debian.org — Third Party Advisory
- www.oracle.com — Patch, Third Party Advisory
PUBLISHED 2022-05-12T04:15:07-04:00
MODIFIED 2026-10-08T18:17:20-04:00
INGESTED 2026-10-10T20:50:21-04:00