trafficserver - security update
trafficserver - security update
- Actualiza a 9.2.5+ds-0+deb12u2
Publicación Actualización
PatchFirst · Vulnerabilidades recientes
Vulnerabilidades de trafficserver · Página 4
Vulnerabilidades publicadas para trafficserver en los últimos 30 días: 16. Incluidas en el catálogo KEV: 0.
Vulnerabilidades: 134
Apache Traffic Server: Malformed chunked message body allows request smuggling
Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes the issue.
- Actualiza a 9.2.5+ds-0+deb12u3
Publicación ActualizaciónApache Traffic Server: Request smuggling via pipelining after a chunked message body
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.
- Actualiza a 9.2.5+ds-0+deb12u2
Publicación ActualizaciónApache Traffic Server: Intercept plugins are not access controlled
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.
- Actualiza a 9.2.5+ds-0+deb12u2
Publicación ActualizaciónApache Traffic Server: Expect header field can unreasonably retain resource
Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue.
- Actualiza a 9.2.5+ds-0+deb12u2
Publicación ActualizaciónApache Traffic Server: Server process can fail to drop privilege
Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes the issue.
- Actualiza a 9.2.5+ds-0+deb12u2
Publicación ActualizaciónApache Traffic Server: Valid Host field value can cause crashes
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Actualiza a 9.2.5+ds-0+deb12u2
Publicación ActualizaciónApache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Actualiza a 9.2.5+ds-0+deb12u2
Publicación Actualizacióntrafficserver - security update
trafficserver - security update
- Actualiza a 9.2.5+ds-0+deb12u1
Publicación ActualizaciónApache Traffic Server: Incomplete field name check allows request smuggling
Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
- Actualiza a 9.2.5+ds-0+deb12u1
Publicación ActualizaciónApache Traffic Server: Invalid Accept-Encoding can force forwarding requests
Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
- Actualiza a 9.2.5+ds-0+deb12u1
Publicación ActualizaciónApache Traffic Server: Incomplete check for chunked trailer section allows request smuggling
Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked trailer section. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
- Actualiza a 9.2.5+ds-0+deb12u1
Publicación Actualizacióntrafficserver - security update
trafficserver - security update
- Actualiza a 9.2.4+ds-0+deb12u1
Publicación ActualizaciónApache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
- Actualiza a 9.2.4+ds-0+deb12u1
Publicación Actualizacióntrafficserver - security update
trafficserver - security update
- Actualiza a 9.2.3+ds-1+deb12u1
Publicación ActualizaciónApache Traffic Server: Malformed http/2 frames can cause an abort
Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue.
- Actualiza a 9.2.3+ds-1+deb12u1
Publicación ActualizaciónApache Traffic Server: s3_auth plugin problem with hash calculation
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.
- Actualiza a 9.2.3+ds-1+deb12u1
Publicación ActualizaciónCVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
- Actualiza a 9.2.3+ds-1+deb12u1
Publicación ActualizaciónApache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies
Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
- Actualiza a 9.2.3+ds-1+deb12u1
Publicación ActualizaciónApache Traffic Server: Invalid Range header causes a crash
Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
- Actualiza a 9.2.3+ds-1+deb12u1
Publicación Actualización
Comprueba tu servidor
Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.