Re: CVE-2022-29885

2022-06-22 Thread Stephane Passignat
thank you Mark Le 2022-06-22 à 11:52, Mark Thomas a écrit : On 22/06/2022 10:18, Stephane Passignat wrote: Hello, I'm trying to understand this CVE and EncryptInterceptor. So far my understanding is EncryptInterceptor is used in clustered environment. Am I right ? Reading the content of

Re: CVE-2022-29885

2022-06-22 Thread Mark Thomas
On 22/06/2022 10:18, Stephane Passignat wrote: Hello, I'm trying to understand this CVE and EncryptInterceptor. So far my understanding is EncryptInterceptor is used in clustered environment. Am I right ? Reading the content of the commit and release content, that's only look like a

CVE-2022-29885

2022-06-22 Thread Stephane Passignat
Hello, I'm trying to understand this CVE and EncryptInterceptor. So far my understanding is EncryptInterceptor is used in clustered environment. Am I right ? Reading the content of the commit and release content, that's only look like a documentation issue. Are there really any DDOS

Re: Apache Tomcat EncryptInterceptor DoS CVE-2022-29885 vulnerability question

2022-05-31 Thread Mark Thomas
On 31/05/2022 16:17, DeHaven, Jacob wrote: In regards, to the Low: Apache Tomcat EncryptInterceptor DoS  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29885 which is fixed in Apache Tomcat 9.0.63, it is being reporting as a Low vulnerability on the Apache Tomcat website but others

Re: Apache Tomcat EncryptInterceptor DoS CVE-2022-29885 vulnerability question

2022-05-31 Thread Christopher Schultz
Jacob, On 5/31/22 11:17, DeHaven, Jacob wrote: In regards, to the Low: Apache Tomcat EncryptInterceptor DoS http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29885 which is fixed in Apache Tomcat 9.0.63, it is being reporting as a Low vulnerability on the Apache Tomcat website but others

Apache Tomcat EncryptInterceptor DoS CVE-2022-29885 vulnerability question

2022-05-31 Thread DeHaven, Jacob
In regards, to the Low: Apache Tomcat EncryptInterceptor DoS  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29885 which is fixed in Apache Tomcat 9.0.63, it is being reporting as a Low vulnerability on the Apache Tomcat website but others (NIST, Tenable) are reporting

[SECURITY] CVE-2022-29885 Apache Tomcat EncryptInterceptor DoS

2022-05-10 Thread Mark Thomas
CVE-2022-29885 Apache Tomcat EncryptInterceptor Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 10.1.0-M1 to 10.1.0-M14 Apache Tomcat 10.0.0-M1 to 10.0.20 Apache Tomcat 9.0.13 to 9.0.62 Apache Tomcat 8.5.38 to 8.5.78 Description: The documentation