PT-2023-3286 · Apache · Apache Traffic Server

Chris Lemmons · Published 2023-06-13 · Updated 2024-02-01 · CVE-2023-30631

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 9.2.0

Description The issue is related to improper input validation in Apache Traffic Server. The configuration option proxy.config.http.push method enabled did not function as expected. However, by default, the PUSH method is blocked in the ip allow configuration file. This could potentially allow a remote attacker to cause a denial of service.

Recommendations 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-03423

CVE-2023-30631

DLA-3475-1

DSA-5435-1

DSA-5435-2

Affected Products

Apache Traffic Server

References · 32

• https://osv.dev/vulnerability/DLA-3475-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30631 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6GDCBNFDDW6ULW7CACJCPENI7BVDHM5O · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-30631 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-3475-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33933 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-30631 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30631 · Security Note
• https://bdu.fstec.ru/vul/2023-03516 · Security Note
• https://bdu.fstec.ru/vul/2023-03413 · Security Note
• https://osv.dev/vulnerability/CVE-2023-30631 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03423 · Security Note
• https://security-tracker.debian.org/tracker/DSA-5435-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-5435-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-30631 · Vendor Advisory