PT-2023-3286 · Apache · Apache Traffic Server

Chris Lemmons · Publicado 2023-06-13 · Atualizado 2024-02-01 · CVE-2023-30631

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 9.2.0

Description The issue is related to improper input validation in Apache Traffic Server. The configuration option proxy.config.http.push method enabled did not function as expected. However, by default, the PUSH method is blocked in the ip allow configuration file. This could potentially allow a remote attacker to cause a denial of service.

Recommendations 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2023-03423

CVE-2023-30631

DLA-3475-1

DSA-5435-1

DSA-5435-2

Produtos afetados

Apache Traffic Server

Referências · 32

• https://osv.dev/vulnerability/DLA-3475-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30631 · Nota de Segurança
• https://t.me/cvenotify/52869 · Publicação no Telegram
• https://packetstormsecurity.com/files/cve/CVE-2023-30631 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6GDCBNFDDW6ULW7CACJCPENI7BVDHM5O · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-30631 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DLA-3475-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33933 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-30631 · Aviso do Fabricante
• https://packages.debian.org/src:trafficserver · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-30631 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30631 · Nota
• https://bdu.fstec.ru/vul/2023-03516 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-03413 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-30631 · Aviso do Fabricante