p PatchFirst

CVE-2024-35161

CVE-2024-35161 · Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked trailer section. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.

CVSS 9.1 · Critical · EPSS 1.0% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache traffic server

    Versions
    • ≥ 8.0.0, ≤ 8.1.10: Affected (semver)
    • ≥ 9.0.0, ≤ 9.2.4: Affected (semver)

    No fix published

  • trafficserver Debian:12

    Versions
    • 9.2.0+ds-2
    • 9.2.0+ds-2+deb12u1
    • 9.2.1+ds-1
    • 9.2.2+ds-1
    • 9.2.3+ds-1
    • 9.2.3+ds-1+deb12u1
    • 9.2.4+ds-0+deb12u1
    • 9.2.4+ds-1
    • 9.2.4+ds-2
    Affected ranges
    • ECOSYSTEM: < 9.2.5+ds-0+deb12u1

    Update to 9.2.5+ds-0+deb12u1

  • trafficserver Ubuntu:16.04:LTS

    Versions
    • 5.3.0-2ubuntu1
    • 5.3.0-2ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • trafficserver Ubuntu:18.04:LTS

    Versions
    • 7.0.0-5
    • 7.1.2+ds-2
    • 7.1.2+ds-2build1
    • 7.1.2+ds-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • trafficserver Ubuntu:Pro:20.04:LTS

    Versions
    • 8.0.5+ds-1
    • 8.0.5+ds-2
    • 8.0.5+ds-2build1
    • 8.0.5+ds-2ubuntu1
    • 8.0.5+ds-3
    • 8.0.5+ds-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • trafficserver Ubuntu:Pro:22.04:LTS

    Versions
    • 8.1.1+ds-1.1
    • 9.1.1+ds-2build1
    • 9.1.1+ds-2ubuntu0.1~esm1
    • 9.1.1+ds-2ubuntu0.1
    • 9.1.1+ds-2ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • trafficserver Ubuntu:24.04:LTS

    Versions
    • 9.2.1+ds-1build1
    • 9.2.2+ds-1
    • 9.2.3+ds-1
    • 9.2.3+ds-1+deb12u1
    • 9.2.3+ds-1+deb12u1build1
    • 9.2.3+ds-1+deb12u1build3
    • 9.2.3+ds-1+deb12u1build4
    • 9.2.3+ds-1+deb12u1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →