Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Debian 10: DLA-3279-1 Critical: Trafficserver Input Validation Issues

debian lts
Calendar Grey January 23, 2023
Dist Debian Esm H88
Several problems identified in trafficserver impacting its caching abilities and proxy functionality. A system upgrade is suggested to enhance security.
Multiple vulnerabilities were found in trafficserver, a caching proxy server
Topics%20covered

Topics Covered

security advisory critical debian vulnerability input validation caching proxy trafficserver

Summary

CVE-2021-37150

Improper Input Validation vulnerability in header parsing of
Apache Traffic Server allows an attacker to request secure
resources

CVE-2022-25763

Improper Input Validation vulnerability in HTTP/2 request
validation of Apache Traffic Server allows an attacker to create
smuggle or cache poison attacks.

CVE-2022-28129

Improper Input Validation vulnerability in HTTP/1.1 header parsing
of Apache Traffic Server allows an attacker to send invalid
headers
CVE-2022-31780

Improper Input Validation vulnerability in HTTP/2 frame handling
of Apache Traffic Server allows an attacker to smuggle requests.

For Debian 10 buster, these problems have been fixed in version
8.0.2+ds-1+deb10u7.

We recommend that you upgrade your trafficserver packages.

For the detailed security status of trafficserver please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/trafficserver

Read the Full Advisory


Severity
critical
Lowest
Low
Medium
High
Critical

Package: trafficserver
Version: 8.0.2+ds-1+deb10u7
CVE ID: CVE-2021-37150 CVE-2022-25763 CVE-2022-28129

Topics%20covered

Topics Covered

security advisory critical debian vulnerability input validation caching proxy trafficserver

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here