High WID-SEC-2024-1713 3 CVEs

Apache Traffic Server: Mehrere Schwachstellen

Published Jul 25, 2024 · Updated Sep 26, 2024 · Revision 4 · de-DE

Vendor: Apache Vendor: Debian Vendor: Fedora Product: Linux Product: Linux Product: Traffic Server Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Traffic Server ausnutzen, um einen Denial of Service Angriff durchzuführen oder Sicherheitsmaßnahmen zu umgehen.

Product

Apache Traffic Server ist ein skalier- und erweiterbarer, mit HTTP/1.1 kompatibler "caching proxy server".

Vulnerabilities 3

Critical 9.1

CVE-2024-35161

Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling

Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 th…

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Jul 26, 2024
High 8.2

CVE-2024-35296

Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.1…

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Jul 26, 2024
High 7.5

CVE-2023-38522

Apache Traffic Server: Incomplete field name check allows request smuggling

Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue…

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Jul 26, 2024

Revision history

2024-09-26 #4
Neue Updates von Debian aufgenommen
2024-08-25 #3
Neue Updates von Debian aufgenommen
2024-07-28 #2
Neue Updates von Fedora aufgenommen
2024-07-25 #1
Initiale Fassung

References

Apache Mailing List vom 2024-07-25
https://lists.apache.org/thread/kqv2fjn85ypl8vynhoghydnrf6lsvwbk
OSS Security Mailing List vom 2024-07-25
https://seclists.org/oss-sec/2024/q3/112
Fedora Security Advisory FEDORA-EPEL-2024-504D1ABDB5 vom 2024-07-27
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-504d1abdb5
Fedora Security Advisory FEDORA-2024-2243C5ABEE vom 2024-07-27
https://bodhi.fedoraproject.org/updates/FEDORA-2024-2243c5abee
Fedora Security Advisory FEDORA-2024-77FE791124 vom 2024-07-27
https://bodhi.fedoraproject.org/updates/FEDORA-2024-77fe791124
Fedora Security Advisory FEDORA-EPEL-2024-D40458DB4B vom 2024-07-27
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-d40458db4b
Debian Security Advisory DSA-5758 vom 2024-08-26
https://lists.debian.org/debian-security-announce/2024/msg00171.html
Debian Security Advisory DLA-3897 vom 2024-09-27
https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html