trafficserver - security update

Fixed packages 2

Vulnerabilities 4

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• Critical 9.1
  CVE-2023-33934

  Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies

  Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.

  Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu
  Aug 9, 2023
• High 7.5
  CVE-2022-47185

  Apache Traffic Server: Invalid Range header causes a crash

  Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.

  Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu
  Aug 9, 2023
• High 7.5
  CVE-2023-41752

  Apache Traffic Server: s3_auth plugin problem with hash calculation

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which f…

  Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu Alpine
  Oct 17, 2023