PT-2023-4534 · Apache · Apache Traffic Server

Adi Peleg + 5 · Publicado 2023-08-09 · Atualizado 2024-10-01 · CVE-2023-33934

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions through 9.2.1

Description The issue is related to improper input validation in Apache Traffic Server, which can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions through 9.2.1, update to a version later than 9.2.1 to resolve the issue. As a temporary workaround, consider restricting input validation to minimize the risk of exploitation.

Exploit

Correção

RCE

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-20

CWE-444

Identificadores relacionados

BDU:2023-04939

CVE-2023-33934

DLA-3595-1

DSA-5549-1

Produtos afetados

Apache Traffic Server

Referências · 65

• 🔥 https://github.com/bcdannyboy/CVE-2023-44487 · Exploit
• 🔥 https://github.com/imabee101/CVE-2023-44487 · Exploit
• 🔥 https://github.com/studiogangster/CVE-2023-44487 · Exploit
• 🔥 https://github.com/nxenon/cve-2023-44487 · Exploit
• https://github.com/secengjeff/rapidresetclient · Nota
• https://github.com/terrorist/HTTP-2-Rapid-Reset-Client · Nota
• https://github.com/micrictor/http2-rst-stream · Nota
• https://github.com/ndrscodes/http2-rst-stream-attacker · Nota
• https://t.me/cvenotify/96742 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2023-33934 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44487 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33934 · Nota
• https://safe-surf.ru/specialists/bulletins-nkcki/699819 · Nota de Segurança
• https://safe-surf.ru/specialists/bulletins-nkcki/703128 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2023-33934 · Nota de Segurança