High WID-SEC-2022-2370 3 CVEs

Apache Traffic Server: Mehrere Schwachstellen

Published Dec 19, 2022 · Updated Apr 5, 2023 · Revision 4 · de-DE

Vendor: Apache Vendor: Debian Product: Linux Product: Traffic Server Product: Traffic Server < 8.1.6 Product: Traffic Server < 9.1.4

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Apache Traffic Server ausnutzen, um einen Denial of Service Angriff durchzuführen und einen Cross-Site-Scripting Angriff auszuführen.

Product

Apache Traffic Server ist ein skalier- und erweiterbarer, mit HTTP/1.1 kompatibler "caching proxy server".

Vulnerabilities 3

High 7.5

CVE-2022-32749

Apache Traffic Server: Improperly handled requests can cause crashes in specific plugins

Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions. This issue affects Apache Traffic Server: from 8.0.0 through 9.1.3.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Dec 19, 2022
Medium 6.1

CVE-2022-40743

Apache Traffic Server: Security issues with the xdebug plugin

Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. Users should upgrade to 9.…

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Dec 19, 2022
Medium 5.3

CVE-2022-37392

Apache Traffic Server: Improperly reading the client requests

Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Dec 19, 2022

Revision history

2023-04-05 #4
Neue Updates von Debian aufgenommen
2023-01-08 #3
Neue Updates von Debian aufgenommen
2022-12-20 #2
Referenz(en) aufgenommen: FEDORA-2022-489EA47E69, FEDORA-2022-62B61A8542
2022-12-19 #1
Initiale Fassung

References

Debian Security Advisory DLA-3385 vom 2023-04-06
https://lists.debian.org/debian-lts-announce/2023/04/msg00007.html
Apache Traffic Ser er - Announcement vom 2022-12-19
https://lists.apache.org/thread/mrj2lg4s0hf027rk7gz8t7hbn9xpfg02
Bugzilla - Vulnerability Describtion 2022-12-19
https://bugzilla.redhat.com/show_bug.cgi?id=2154895
Bugzilla - Vulnerability Describtion 2022-12-19
https://bugzilla.redhat.com/show_bug.cgi?id=2154898
Bugzilla - Vulnerability Describtion 2022-12-19
https://bugzilla.redhat.com/show_bug.cgi?id=2154901
Debian Security Advisory DSA-5311 vom 2023-01-09
https://www.debian.org/security/2023/dsa-5311