CVE-2023-41752 Apache Traffic Server: s3_auth plugin problem with hash calculation

2023-10-1706:57:47

CWE-200

apache

www.cve.org

cve-2023-41752

apache traffic server

s3_auth plugin

hash calculation

exposure of sensitive information

unauthorized actor

vulnerability

upgrade

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.1%

JSON

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2.

Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Traffic Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "8.1.8",
        "status": "affected",
        "version": "8.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "9.2.2",
        "status": "affected",
        "version": "9.0.0",
        "versionType": "semver"
      }
    ]
  }
]