Skip to content
OpenAdvisories
Unscored CVE-2023-30631 EUVD-2023-34995GHSA-5rc2-qffv-3c8p

Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work

Published Jun 14, 2023 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Traffic Server Package: trafficserver Package: trafficserver Ecosystem: Debian Ecosystem: Ubuntu

Description

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.  The configuration option proxy.config.http.push_method_enabled didn't function.  However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.

8.x users should upgrade to 8.1.7 or later versions
9.x users should upgrade to 9.2.1 or later versions

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Traffic Server 8.0.0 – ≤ 9.2.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 12 trafficserver 9.2.0+ds-2+deb12u1 DSA-5435-1
Debian 11 trafficserver 8.1.7+ds-1~deb11u1 DSA-5435-1
Debian 10 trafficserver 8.1.7-0+deb10u1 DLA-3475-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS trafficserver No fix yet —
Ubuntu 16.04 LTS trafficserver No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS trafficserver No fix yet —
Ubuntu Pro 20.04 LTS trafficserver No fix yet —

Advisories 3

References