This vulnerability is a Padding Oracle attack vector in the EncryptInterceptor of Apache Tomcat, which is used to encrypt communication between cluster nodes. The flaw allows remote attackers to decrypt sensitive data by exploiting cryptographic padding weaknesses. The affected versions include Apache Tomcat from 7.0.100 through 7.0.109, 8.5.38 through 8.5.100, 9.0.13 through 9.0.115, 10.0.0-M1 through 10.1.52, and 11.0.0-M1 through 11.0.18. Red Hat's advisory states that their supported products are not vulnerable because clustering is not supported or tested in those environments. Mitigation includes removing the catalina-tribes.jar file from the Tomcat installation or upgrading to fixed versions 11.0.19, 10.1.53, and 9.0.116. The CVSS v3.1 base score is 7.5 (high severity) with network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact.

The vulnerability allows remote attackers to decrypt sensitive information transmitted between cluster nodes in Apache Tomcat by exploiting padding oracle weaknesses. This compromises confidentiality but does not affect integrity or availability. Red Hat products are not exploitable due to lack of clustering support. No known exploits are reported in the wild.

A fix is available by upgrading Apache Tomcat to versions 11.0.19, 10.1.53, or 9.0.116 or later. Alternatively, mitigation can be applied by removing the affected catalina-tribes.jar file from the Tomcat installation, which disables clustering functionality. If clustering is required, ensure it is disabled before applying this mitigation to avoid service errors. Red Hat advises disabling clustering in their Tomcat distributions and applying the update as per their security advisory.