trafficserver - security update
trafficserver - security update
- Mettez à jour vers 9.2.5+ds-0+deb12u2
Publication Mise à jour
PatchFirst · Vulnérabilités récentes
Vulnérabilités de trafficserver · Page n° 4
Vulnérabilités publiées pour trafficserver au cours des 30 derniers jours : 16. Présentes dans le catalogue KEV : 0.
Vulnérabilités : 134
Apache Traffic Server: Malformed chunked message body allows request smuggling
Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or 10.0.5, which fixes the issue.
- Mettez à jour vers 9.2.5+ds-0+deb12u3
Publication Mise à jourApache Traffic Server: Request smuggling via pipelining after a chunked message body
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.
- Mettez à jour vers 9.2.5+ds-0+deb12u2
Publication Mise à jourApache Traffic Server: Intercept plugins are not access controlled
Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.
- Mettez à jour vers 9.2.5+ds-0+deb12u2
Publication Mise à jourApache Traffic Server: Expect header field can unreasonably retain resource
Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3. Users are recommended to upgrade to versions 9.2.9 or 10.0.4 or newer, which fixes the issue.
- Mettez à jour vers 9.2.5+ds-0+deb12u2
Publication Mise à jourApache Traffic Server: Server process can fail to drop privilege
Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes the issue.
- Mettez à jour vers 9.2.5+ds-0+deb12u2
Publication Mise à jourApache Traffic Server: Valid Host field value can cause crashes
Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Mettez à jour vers 9.2.5+ds-0+deb12u2
Publication Mise à jourApache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.
- Mettez à jour vers 9.2.5+ds-0+deb12u2
Publication Mise à jourtrafficserver - security update
trafficserver - security update
- Mettez à jour vers 9.2.5+ds-0+deb12u1
Publication Mise à jourApache Traffic Server: Incomplete field name check allows request smuggling
Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
- Mettez à jour vers 9.2.5+ds-0+deb12u1
Publication Mise à jourApache Traffic Server: Invalid Accept-Encoding can force forwarding requests
Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
- Mettez à jour vers 9.2.5+ds-0+deb12u1
Publication Mise à jourApache Traffic Server: Incomplete check for chunked trailer section allows request smuggling
Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked trailer section. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
- Mettez à jour vers 9.2.5+ds-0+deb12u1
Publication Mise à jourtrafficserver - security update
trafficserver - security update
- Mettez à jour vers 9.2.4+ds-0+deb12u1
Publication Mise à jourApache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
- Mettez à jour vers 9.2.4+ds-0+deb12u1
Publication Mise à jourtrafficserver - security update
trafficserver - security update
- Mettez à jour vers 9.2.3+ds-1+deb12u1
Publication Mise à jourApache Traffic Server: Malformed http/2 frames can cause an abort
Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue.
- Mettez à jour vers 9.2.3+ds-1+deb12u1
Publication Mise à jourApache Traffic Server: s3_auth plugin problem with hash calculation
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.
- Mettez à jour vers 9.2.3+ds-1+deb12u1
Publication Mise à jourCVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
- Mettez à jour vers 9.2.3+ds-1+deb12u1
Publication Mise à jourApache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies
Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
- Mettez à jour vers 9.2.3+ds-1+deb12u1
Publication Mise à jourApache Traffic Server: Invalid Range header causes a crash
Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
- Mettez à jour vers 9.2.3+ds-1+deb12u1
Publication Mise à jour
Vérifiez votre serveur
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.