PT-2024-5532 · Apache · Apache Traffic Server

Min Chen · Published 2024-07-25 · Updated 2024-09-27 · CVE-2024-35296

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.10 Apache Traffic Server versions 9.0.0 through 9.2.4

Description The issue is related to insufficient input validation, allowing a remote attacker to execute arbitrary requests using the HTTP Accept-Encoding header. An invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests.

Recommendations For Apache Traffic Server versions 8.0.0 through 8.1.10, upgrade to version 8.1.11. For Apache Traffic Server versions 9.0.0 through 9.2.4, upgrade to version 9.2.5. As a temporary workaround, consider restricting the use of the Accept-Encoding header in HTTP requests to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-06198

CVE-2024-35296

DLA-3897-1

DSA-5758-1

OESA-2024-1981

Affected Products

Apache Traffic Server

References · 18

• https://osv.dev/vulnerability/DEBIAN-CVE-2024-35296 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1981 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5758-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35296 · Security Note
• https://bdu.fstec.ru/vul/2024-06198 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-35296 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-35296 · Vendor Advisory
• https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-35296 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-35296 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3897-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-35296 · Security Note
• https://t.me/cvedetector/1673 · Telegram Post
• https://t.me/cvenotify/87518 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html · Note