Stay Secure with the Latest Linux Advisories

security advisoryfedoraimportant

Fedora 41 FEDORA-2025-ed452354bb critical: Traffic Server ACL bypass issue

Changes with Apache Traffic Server 9.2.11 #12169 - 9.2.x: fix libyaml for gcc 15, and cherry-pick fedora:42 updates #12294 - Add a setting to choose the data source of IP address for ACL #12296 - Add max inclusion support to esi plugin for 9.2.x. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-ed452354bb 2025-06-27 01:57:49.068350+00:00 -------------------------------------------------------------------------------- Name : trafficserver Product : Fedora 41 Version : 9.2.11 Release : 1.fc41 URL : https://trafficserver.apache.org/ Summary : Fast, scalable and extensible HTTP/1.1 and HTTP/2 caching proxy server Description : Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching and reusing frequently-requested web pages, images, and web service calls. Proxying - Easily add keep-alive, filter or anonymize content requests, or add load balancing by adding a proxy layer. Fast - Scales well on modern SMP hardware, handling 10s of thousands of requests per second. Extensible - APIs to write your own plug-ins to do anything from modifying HTTP headers to handling ESI requests to writing your own cache algorithm. Proven - Handling over 400TB a day at Yahoo! both as forward and reverse proxies, Apache Traffic Server is battle hardened. -------------------------------------------------------------------------------- Update Information: Changes with Apache Traffic Server 9.2.11 #12169 - 9.2.x: fix libyaml for gcc 15, and cherry-pick fedora:42 updates #12294 - Add a setting to choose the data source of IP address for ACL #12296 - Add max inclusion support to esi plugin for9.2.x -------------------------------------------------------------------------------- ChangeLog: * Tue Jun 17 2025 Jered Floyd 9.2.11-1 - Update to upstream 9.2.11 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2373879 - CVE-2025-31698 trafficserver: Apache Traffic Server PROXY Protocol ACL Bypass [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2373879 [ 2 ] Bug #2373883 - CVE-2025-49763 trafficserver: Traffic Server ESI Inclusion Depth Vulnerability [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2373883 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-ed452354bb' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue . Enhancements in Ubuntu 23's Proxy Server tackle vital vulnerabilities, boosting the efficiency of web applications.. Fedora trafficserver, security advisory, performance update, ESI vulnerability, ACL bypass. . Severity: Critical. LinuxSecurity.com Team

Jun 27, 2025 •Critical Fedora