PT-2024-5230 · Apache · Apache Traffic Server

Keran Mu · Published 2024-07-26 · Updated 2024-09-27 · CVE-2024-35161

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 8.1.10 Apache Traffic Server versions 9.0.0 through 9.2.4

Description: The issue arises from Apache Traffic Server forwarding malformed HTTP chunked trailer sections to origin servers, which can be utilized for request smuggling and may also lead to cache poisoning if the origin servers are vulnerable.

Recommendations: To resolve the issue for versions 8.0.0 through 8.1.10, upgrade to version 8.1.11. To resolve the issue for versions 9.0.0 through 9.2.4, upgrade to version 9.2.5. As a temporary workaround, consider setting the new configuration proxy.config.http.drop chunked trailers to prevent forwarding the chunked trailer section.

Fix

RCE

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-20

CWE-444

Related Identifiers

BDU:2024-05796

CVE-2024-35161

DLA-3897-1

DSA-5758-1

OESA-2024-1955

Affected Products

Apache Traffic Server

References · 22

• https://osv.dev/vulnerability/DSA-5758-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-35161 · Security Note
• https://ubuntu.com/security/CVE-2024-35161 · Vendor Advisory
• https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-35161 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-35161 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1955 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-35161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35161 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-35161 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3897-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38522 · Security Note
• https://bdu.fstec.ru/vul/2024-05796 · Security Note
• https://docs.trafficserver.apache.org/admin-guide/files/records.config.en.html · Note
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1955 · Note