CVE-2023-33934

CVE-2023-33934 · Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.

CVSS 9.1 · Critical · EPSS 1.6% · Fix available

Stack: system

Affected products and versions

apache traffic server
Versions
- ≥ 0, ≤ 9.2.1: Affected (semver)
No fix published
trafficserver Debian:12
Versions
- 9.2.0+ds-2
- 9.2.0+ds-2+deb12u1
- 9.2.1+ds-1
- 9.2.2+ds-1
- 9.2.3+ds-1
Affected ranges
- ECOSYSTEM: < 9.2.3+ds-1+deb12u1
Update to 9.2.3+ds-1+deb12u1
trafficserver Ubuntu:16.04:LTS
Versions
- 5.3.0-2ubuntu1
- 5.3.0-2ubuntu2
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
trafficserver Ubuntu:18.04:LTS
Versions
- 7.0.0-5
- 7.1.2+ds-2
- 7.1.2+ds-2build1
- 7.1.2+ds-3
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
trafficserver Ubuntu:Pro:20.04:LTS
Versions
- 8.0.5+ds-1
- 8.0.5+ds-2
- 8.0.5+ds-2build1
- 8.0.5+ds-2ubuntu1
- 8.0.5+ds-3
- 8.0.5+ds-3ubuntu0.1~esm1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
trafficserver Ubuntu:Pro:22.04:LTS
Versions
- 8.1.1+ds-1.1
- 9.1.1+ds-2build1
- 9.1.1+ds-2ubuntu0.1~esm1
- 9.1.1+ds-2ubuntu0.1
- 9.1.1+ds-2ubuntu0.1+esm1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published