David Carlin

**Nome do Software Vulnerável e Versões Afetadas** Versões do Apache Traffic Server de 9.0.0 a 9.2.8 Versões do Apache Traffic Server de 10.0.0 a 10.0.3 **Descrição** O problema é uma vulnerabilidade de Violação de Comportamento Esperado no Apache Traffic Server. Os usuários são aconselhados a atualizar para resolver o problema. **Recomendações** Para as versões do Apache Traffic Server de 9.0.0 a 9.2.8, atualize para a versão 9.2.9 ou superior. Para as versões do Apache Traffic Server de 10.0.0 a 10.0.3, atualize para a versão 10.0.4 ou superior.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions prior to 1.0.1j OpenSSL versions 1.0.1 **Description** The issue concerns multiple vulnerabilities in the OpenSSL package that can be exploited remotely, potentially leading to breaches in confidentiality, integrity, and availability of protected information. A specific flaw in the `ssl get algorithm2` function can cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For OpenSSL versions prior to 1.0.1j, update to version 1.0.1j or later to resolve the issue. For OpenSSL version 1.0.1, consider disabling the `ssl get algorithm2` function as a temporary workaround until a patch is available. Restrict access to TLS 1.2 clients to minimize the risk of exploitation.