CVE-2023-38522

EUVD-2023-42321
Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.

Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
HTTP Request/Response Smuggling
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
apachetraffic_server
8.0.0 ≤
𝑥
< 8.1.11
apachetraffic_server
9.0.0 ≤
𝑥
< 9.2.5
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
apachetraffic_server
8.0.0 ≤
𝑥
≤ 8.1.10
ADP
apachetraffic_server
9.0.0 ≤
𝑥
≤ 9.2.4
ADP
Debian logo
Debian Releases
Debian Product
Codename
trafficserver
bookworm
9.2.5+ds-0+deb12u1
fixed
bookworm (security)
9.2.5+ds-0+deb12u1
fixed
bullseye
vulnerable
bullseye (security)
8.1.11+ds-0+deb11u1
fixed
sid
9.2.5+ds-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
trafficserver
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0
https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0
https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html