Summary
Ein entfernter Angreifer kann mehrere Schwachstellen in Apache Traffic Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Zustand herbeizuführen.
Product
Apache Traffic Server ist ein skalier- und erweiterbarer, mit HTTP/1.1 kompatibler "caching proxy server".
Vulnerabilities 2
-
High 7.5
Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL
ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users can use a new setting (proxy.config.acl.subjects) to choose which IP addresses to use for the ACL if Apache Traffic Server is configured to …
-
High 7.5
Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin
ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traf…
Revision history
-
#2
Neue Updates von Debian aufgenommen
-
#1
Initiale Fassung
References
-
Mailing list OSS Security vom 2025-06-17
https://seclists.org/oss-sec/2025/q2/264
-
Debian Security Advisory DSA-5948 vom 2025-06-25
https://lists.debian.org/debian-security-announce/2025/msg00112.html