p PatchFirst

PatchFirst · Latest vulnerabilities

trafficserver vulnerabilities · Page 5

Vulnerabilities published for trafficserver in the last 30 days: 16. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 134

  2. CVE-2023-30631

    High · CVSS 7.5EPSS 2%Fix available

    Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work

    Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.  The configuration option proxy.config.http.push_method_enabled didn't function.  However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions

    trafficserverOperating systems
    • Update to 9.2.0+ds-2+deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2023-33933

    High · CVSS 7.5EPSS 1.51%Fix available

    Apache Traffic Server: s3_auth plugin problem with hash calculation

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions

    trafficserverOperating systems
    • Update to 9.2.0+ds-2+deb12u1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  5. CVE-2022-40743

    Medium · CVSS 6.1EPSS 1.15%Fix available

    Apache Traffic Server: Security issues with the xdebug plugin

    Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. Users should upgrade to 9.1.4 or later versions.

    trafficserverOperating systems
    • Update to 9.1.4+ds-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2022-37392

    Medium · CVSS 5.3EPSS 1.18%Fix available

    Apache Traffic Server: Improperly reading the client requests

    Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

    trafficserverOperating systems
    • Update to 9.1.4+ds-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2022-32749

    High · CVSS 7.5EPSS 1.39%Fix available

    Apache Traffic Server: Improperly handled requests can cause crashes in specific plugins

    Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions. This issue affects Apache Traffic Server: from 8.0.0 through 9.1.3.

    trafficserverOperating systems
    • Update to 9.1.4+ds-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2021-43082

    Critical · CVSS 9.8EPSS 2.41%Fix available

    heap-buffer-overflow with stats-over-http plugin

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0.

    trafficserverOperating systems
    • Update to 9.1.1+ds-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →