PT-2022-21442 · Apache · Apache Traffic Server

Vijay Mamidi · Published 2022-12-19 · Updated 2023-04-06 · CVE-2022-32749

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 9.1.3

Description An Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions.

Recommendations For Apache Traffic Server versions 8.0.0 through 9.1.3, update to a version later than 9.1.3 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2022-32749

DLA-3385-1

DSA-5311-1

OESA-2022-2164

OESA-2022-2166

Affected Products

Apache Traffic Server

References · 21

• https://osv.dev/vulnerability/DEBIAN-CVE-2022-32749 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-32749 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5311-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32749 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-32749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32749 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-32749 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-32749 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-40743 · Security Note
• https://osv.dev/vulnerability/OESA-2022-2164 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3385-1 · Vendor Advisory
• https://lists.apache.org/thread/mrj2lg4s0hf027rk7gz8t7hbn9xpfg02 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37392 · Security Note
• https://osv.dev/vulnerability/OESA-2022-2166 · Vendor Advisory
• https://github.com/apache/trafficserver/commit/71a80d1abb3fbcb2e30ff850c8bca0a371589b5a · Note