Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Traffic Server ausnutzen, um Daten zu manipulieren, einen Denial-of-Service-Zustand zu erzeugen oder einen unspezifischen Angriff durchzuführen.
Product
Apache Traffic Server ist ein skalier- und erweiterbarer, mit HTTP/1.1 kompatibler "caching proxy server".
Vulnerabilities 3
-
Critical 9.1
Apache Traffic Server: Server process can fail to drop privilege
Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes th…
-
High 7.5
Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does no…
-
High 7.5
Apache Traffic Server: Valid Host field value can cause crashes
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have th…
Revision history
-
#4
Neue Updates von Ubuntu aufgenommen
-
#3
Neue Updates von Debian aufgenommen
-
#2
Neue Updates von Debian aufgenommen
-
#1
Initiale Fassung
References
-
OSS Security MAiling List vom 2024-11-13
https://seclists.org/oss-sec/2024/q4/91
-
Debian Security Advisory DLA-4055 vom 2025-02-16
https://lists.debian.org/debian-lts-announce/2025/02/msg00018.html
-
Debian Security Advisory DSA-5896 vom 2025-04-05
https://lists.debian.org/debian-security-announce/2025/msg00058.html
-
Ubuntu Security Notice USN-8050-1 vom 2026-02-18
https://ubuntu.com/security/notices/USN-8050-1