Skip to content
OpenAdvisories
High · 7.5 CVE-2022-47184 EUVD-2022-49959GHSA-5r5w-ww4m-44x3

Apache Traffic Server: The TRACE method can be use to disclose network information

Published Jun 14, 2023 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Traffic Server Package: trafficserver Package: trafficserver Ecosystem: Debian Ecosystem: Ubuntu

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Traffic Server 8.0.0 – ≤ 9.2.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 12 trafficserver 9.2.0+ds-2+deb12u1 DSA-5435-1
Debian 11 trafficserver 8.1.7+ds-1~deb11u1 DSA-5435-1
Debian 10 trafficserver 8.1.7-0+deb10u1 DLA-3475-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS trafficserver No fix yet —
Ubuntu 16.04 LTS trafficserver No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS trafficserver No fix yet —
Ubuntu Pro 20.04 LTS trafficserver No fix yet —

Advisories 3

References