Alerts This Week
Warning Icon 1 646
Alerts This Week
Warning Icon 1 646

Fedora 40: FEDORA-2024-b3c4e8da81 critical: trafficserver TLS issues

fedora
Calendar Grey November 22, 2024
Dist Fedora Esm H88
Important patch for Fedora Trafficserver dealing with major vulnerabilities impacting TLS encryption and cache management.
Update to upstream 9.2.6 Backport fix for broken oubound TLS with OpenSSL 3.2+ Resolves CVE-2024-38479, CVE-2024-50305, CVE-2024-50306

Summary

Traffic Server is a high-performance building block for cloud services.

It's more than just a caching proxy server; it also has support for

plugins to build large scale web applications. Key features:

Caching - Improve your response time, while reducing server load and

bandwidth needs by caching and reusing frequently-requested web pages,

images, and web service calls.

Proxying - Easily add keep-alive, filter or anonymize content

requests, or add load balancing by adding a proxy layer.

Fast - Scales well on modern SMP hardware, handling 10s of thousands

of requests per second.

Extensible - APIs to write your own plug-ins to do anything from

modifying HTTP headers to handling ESI requests to writing your own

cache algorithm.

Proven - Handling over 400TB a day at Yahoo! both as forward and

reverse proxies, Apache Traffic Server is battle hardened.

Update Information:

Update to upstream 9.2.6 Backport fix for broken oubound TLS with OpenSSL 3.2+ Resolves CVE-2024-38479, CVE-2024-50305, CVE-2024-50306

Topics%20covered

Topics Covered

security advisory critical Fedora OpenSSL cache poisoning TLS trafficserver

Change Log

* Tue Nov 12 2024 Jered Floyd 9.2.6-2 - Backport fix for broken oubound TLS with OpenSSL 3.2+ * Tue Nov 12 2024 Jered Floyd 9.2.6-1 - Update to upstream 9.2.6

References


[ 1 ] Bug #2326136 - trafficserver stopped working after upgrade from F39 to F40 - connection to backendserver is finished before data flows https://bugzilla.redhat.com/show_bug.cgi?id=2326136 [ 2 ] Bug #2326235 - CVE-2024-50306 trafficserver: Apache Traffic Server: Server process can fail to drop privilege [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2326235 [ 3 ] Bug #2326240 - CVE-2024-50305 trafficserver: Apache Traffic Server: Valid Host field value can cause crashes [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2326240 [ 4 ] Bug #2326245 - CVE-2024-38479 trafficserver: Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2326245

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-b3c4e8da81' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: trafficserver
Product: Fedora 40
Version: 9.2.6
Release: 2.fc40
URL: https://trafficserver.apache.org/
Summary: Fast, scalable and extensible HTTP/1.1 and HTTP/2 caching proxy server

Topics%20covered

Topics Covered

security advisory critical Fedora OpenSSL cache poisoning TLS trafficserver

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here