High WID-SEC-2025-0497 4 CVEs

Apache Traffic Server: Mehrere Schwachstellen

Published Mar 5, 2025 · Updated Apr 6, 2025 · Revision 2 · de-DE

Vendor: Apache Vendor: Debian Product: Linux Product: Traffic Server Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Traffic Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen und weitere, nicht spezifizierte Auswirkungen zu erzielen.

Product

Apache Traffic Server ist ein skalier- und erweiterbarer, mit HTTP/1.1 kompatibler "caching proxy server".

Vulnerabilities 4

Medium 6.3

CVE-2024-38311

Apache Traffic Server: Request smuggling via pipelining after a chunked message body

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fix…

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Mar 6, 2025
Medium 6.3

CVE-2024-56195

Apache Traffic Server: Intercept plugins are not access controlled

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Mar 6, 2025
Medium 6.3

CVE-2024-56196

Apache Traffic Server: ACL is not fully compatible with older versions

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 10.0.4, which fixes the issue.

Apache Software Foundation Apache Traffic Server

Mar 6, 2025
Medium 4.3

CVE-2024-56202

Apache Traffic Server: Expect header field can unreasonably retain resource

Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue.

Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu

Mar 6, 2025

Revision history

2025-04-06 #2
Neue Updates von Debian aufgenommen
2025-03-05 #1
Initiale Fassung

References

Apache Mailing List vom 2025-03-05
https://lists.apache.org/thread/btofzws2yqskk2n7f01r3l1819x01023
Nist Vulnerability Database vom 2025-03-05
https://nvd.nist.gov/vuln/detail/CVE-2024-38311
Nist Vulnerability Database vom 2025-03-05
https://nvd.nist.gov/vuln/detail/CVE-2024-56195
Nist Vulnerability Database vom 2025-03-05
https://nvd.nist.gov/vuln/detail/CVE-2024-56196
Nist Vulnerability Database vom 2025-03-05
https://nvd.nist.gov/vuln/detail/CVE-2024-56202
Debian Security Advisory DSA-5896 vom 2025-04-05
https://lists.debian.org/debian-security-announce/2025/msg00058.html