Apache Traffic Server: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 7.5
  CVE-2023-39456 EPSS 58%

  Apache Traffic Server: Malformed http/2 frames can cause an abort

  Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue.

  Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu Alpine
  Oct 17, 2023
• High 7.5
  CVE-2023-41752

  Apache Traffic Server: s3_auth plugin problem with hash calculation

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which f…

  Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu Alpine
  Oct 17, 2023

Revision history

1. 2023-11-05 #2

   Neue Updates von Debian aufgenommen

2. 2023-10-16 #1

   Initiale Fassung

References

• Debian Security Advisory DSA-5549 vom 2023-11-06
  https://www.debian.org/security/2023/dsa-5549
• Debian Security Advisory DSA-5549 vom 2023-11-05
  https://lists.debian.org/debian-security-announce/2023/msg00245.html
• Debian Security Advisory DLA-3645 vom 2023-11-05
  https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html
• Github Security Advisory vom 2023-10-16
  https://github.com/advisories/GHSA-fr7h-j3xj-fvvv
• Github Security Advisory vom 2023-10-16
  https://github.com/advisories/GHSA-3vrx-27jg-h7pf