Loading vulnerability…
Insufficient secure-configuration documentation for Apache Tomcat EncryptInterceptor
Apache Tomcat insufficiently documents the requirements for securely configuring EncryptInterceptor, potentially leading administrators to deploy insecure cluster communication configurations. Affected versions are 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, 9.0.13 through 9.0.119, 8.5.38 through 8.5.100, and 7.0.100 through 7.0.109. Other end-of-support versions may also be affected. The weakness concerns configuration guidance rather than an identified implementation defect in the encryption component.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Insecure EncryptInterceptor configurations can weaken protection of intra-cluster communications and potentially expose sensitive information. The precise consequences depend on the deployed configuration; specific configuration errors and exploitation mechanics are currently not available.
If you can’t patch tonight, do this now.
Review deployments using EncryptInterceptor and apply Apache's corrected secure-configuration guidance. Specific required settings and a separate temporary workaround are currently not available.
Patch, then assume compromise.
Upgrade to Apache Tomcat 11.0.24 or later, 10.1.57 or later, or 9.0.120 or later within the applicable supported branch, or install the corresponding distribution security update. Review existing EncryptInterceptor configurations against the corrected secure-configuration guidance rather than assuming an upgrade alone corrects deployed settings. No fixed releases are identified for the affected 8.5.x and 7.0.x branches; migrate those installations to a supported, fixed branch.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
48 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.