Skip to content
OpenAdvisories
High · 7.5 CVE-2023-33933 EUVD-2023-38083GHSA-2873-9vw6-x36q

Apache Traffic Server: s3_auth plugin problem with hash calculation

Published Jun 14, 2023 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Traffic Server Package: trafficserver Package: trafficserver Ecosystem: Debian Ecosystem: Ubuntu

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.

8.x users should upgrade to 8.1.7 or later versions
9.x users should upgrade to 9.2.1 or later versions

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Traffic Server 8.0.0 – ≤ 9.2.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 12 trafficserver 9.2.0+ds-2+deb12u1 DSA-5435-1
Debian 11 trafficserver 8.1.7+ds-1~deb11u1 DSA-5435-1
Debian 10 trafficserver 8.1.7-0+deb10u1 DLA-3475-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS trafficserver No fix yet —
Ubuntu 16.04 LTS trafficserver No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS trafficserver No fix yet —
Ubuntu Pro 20.04 LTS trafficserver No fix yet —

Advisories 3

References