PT-2024-5231 · Apache · Apache Traffic Server

Ben Kallus · Published 2024-07-26 · Updated 2025-09-19 · CVE-2023-38522

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 8.1.10 Apache Traffic Server versions 9.0.0 through 9.2.4

Description: The issue exists due to insufficient input validation, allowing an attacker to exploit the vulnerability and potentially conduct HTTP request smuggling attacks, which may also lead to cache poisoning if the origin servers are vulnerable.

Recommendations: For Apache Traffic Server versions 8.0.0 through 8.1.10, upgrade to version 8.1.11. For Apache Traffic Server versions 9.0.0 through 9.2.4, upgrade to version 9.2.5.

Fix

RCE

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-86

CWE-20

CWE-444

Related Identifiers

BDU:2024-05797

CVE-2023-38522

DLA-3897-1

DSA-5758-1

OESA-2024-1955

Affected Products

Apache Traffic Server

References · 23

• https://osv.dev/vulnerability/DSA-5758-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-38522 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-38522 · Vendor Advisory
• https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-38522 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05797 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38522 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38522 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-38522 · Security Note
• https://osv.dev/vulnerability/DLA-3897-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35161 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-38522 · Vendor Advisory
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1955 · Note
• https://t.me/cvenotify/90226 · Telegram Post