{"action":"Upgrade org.apache.tomcat:tomcat to 8.5.79 (8.5.x), 9.0.63 (9.0.x), 10.0.21 (10.0.x) or 10.1.0-M15 (10.1.x) or later.","affected":[{"fixed":"10.1.0-M15","introduced":"10.1.0-M1"},{"fixed":"10.0.21","introduced":"10.0.0-M1"},{"fixed":"9.0.63","introduced":"9.0.13"},{"fixed":"8.5.79","introduced":"8.5.38"}],"component":"org.apache.tomcat:tomcat","cve_ids":["CVE-2022-29885"],"ecosystem":"Maven","epss":0.73474,"exploited":false,"fixed_versions":["10.1.0-M15","10.0.21","9.0.63","8.5.79"],"ghsa_id":"GHSA-r84p-88g2-2vx2","id":"tcs_01M5N9B85YXAX6WF1V6S2WVRXK","modified_at":"2024-03-11T19:11:34.914181Z","published_at":"2022-05-13T00:01:12Z","references":["https://osv.dev/vulnerability/GHSA-r84p-88g2-2vx2","https://nvd.nist.gov/vuln/detail/CVE-2022-29885","https://github.com/apache/tomcat/commit/0fa7721f11d565a2cd2e44366c388ad6a3e6357d","https://github.com/apache/tomcat/commit/36826ea638457d7e17876a70f89cb435b6db0d91","https://github.com/apache/tomcat/commit/b679bc627f5a4ea6510af95adfb7476b07eba890","https://github.com/apache/tomcat/commit/eaafd28296c54d983e28a47953c1f5cb2c334f48","https://github.com/apache/tomcat","https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv","https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html","https://security.netapp.com/advisory/ntap-20220629-0002","https://www.debian.org/security/2022/dsa-5265","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-r84p-88g2-2vx2","url":"https://osv.dev/vulnerability/GHSA-r84p-88g2-2vx2"}],"summary":"Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption"}