Medium WID-SEC-2022-0992 6 CVEs

Apache Traffic Server: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Published Aug 9, 2022 · Updated Apr 5, 2023 · Revision 5 · de-DE

Vendor: Apache Vendor: Debian Product: Linux Product: Traffic Server Product: Traffic Server < 8.1.5 Product: Traffic Server < 9.1.3 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Traffic Server ausnutzen, um Dateien zu manipulieren oder sonstige Auswirkungen zu verursachen.

Product

Apache Traffic Server ist ein skalier- und erweiterbarer, mit HTTP/1.1 kompatibler "caching proxy server".

Vulnerabilities 6

Medium 6.8

CVE-2022-25763

Improper input validation on HTTP/2 headers

Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Aug 10, 2022
Medium 4.2

CVE-2021-37150

Protocol vs scheme mismatch

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Aug 10, 2022
Unscored —

CVE-2022-28129

Insufficient Validation of HTTP/1.x Headers

Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Aug 10, 2022
Unscored —

CVE-2022-31778

Transfer-Encoding not treated as hop-by-hop

Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Aug 10, 2022
Unscored —

CVE-2022-31779

Improper HTTP/2 scheme and method validation

Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Aug 10, 2022
Unscored —

CVE-2022-31780

HTTP/2 framing vulnerabilities

Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Aug 10, 2022

Revision history

2023-04-05 #5
Neue Updates von Debian aufgenommen
2023-01-22 #4
Neue Updates von Debian aufgenommen
2022-08-14 #3
Neue Updates von Debian aufgenommen
2022-08-11 #2
Referenz(en) aufgenommen: FEDORA-2022-23043F5A0B, FEDORA-2022-9832C0C04B
2022-08-09 #1
Initiale Fassung

References

Debian Security Advisory DLA-3385 vom 2023-04-06
https://lists.debian.org/debian-lts-announce/2023/04/msg00007.html
Apache Security Advisory vom 2022-08-09
https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21
NIST Database vom 2022-08-09
https://nvd.nist.gov/vuln/detail/CVE-2022-31779
Debian Security Advisory DSA-5206 vom 2022-08-12
https://lists.debian.org/debian-security-announce/2022/msg00175.html
Debian Security Advisory DLA-3279 vom 2023-01-23
https://lists.debian.org/debian-lts-announce/2023/01/msg00019.html