[SECURITY] [DLA 3799-1] trafficserver security update

2024-04-2820:55:45

lists.debian.org

dos

apache traffic server

trafficserver

http/2

cve-2024-31309

debian 10 buster

security update

AI Score

7.5

Confidence

High

EPSS

Percentile

14.2%

JSON

Debian LTS Advisory DLA-3799-1 [email protected]
https://www.debian.org/lts/security/ Adrian Bunk
April 28, 2024 https://wiki.debian.org/LTS

Package : trafficserver
Version : 8.1.7-0+deb10u4
CVE ID : CVE-2024-31309
Debian Bug : 1068417

Potential DoS attacks have been fixed by rate limiting
HTTP/2 CONTINUATION frames in Apache Traffic Server,
an HTTP/1.1 and HTTP/2 compliant caching proxy server.

For Debian 10 buster, this problem has been fixed in version
8.1.7-0+deb10u4.

We recommend that you upgrade your trafficserver packages.

For the detailed security status of trafficserver please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/trafficserver

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian11amd64trafficserver-dev< 8.1.10+ds-1~deb11u1trafficserver-dev_8.1.10+ds-1~deb11u1_amd64.deb
Debian11i386trafficserver< 8.1.10+ds-1~deb11u1trafficserver_8.1.10+ds-1~deb11u1_i386.deb
Debian11armhftrafficserver-experimental-plugins< 8.1.10+ds-1~deb11u1trafficserver-experimental-plugins_8.1.10+ds-1~deb11u1_armhf.deb
Debian11ppc64eltrafficserver-experimental-plugins< 8.1.10+ds-1~deb11u1trafficserver-experimental-plugins_8.1.10+ds-1~deb11u1_ppc64el.deb
Debian11armhftrafficserver-dbgsym< 8.1.10+ds-1~deb11u1trafficserver-dbgsym_8.1.10+ds-1~deb11u1_armhf.deb
Debian11mips64eltrafficserver-dbgsym< 8.1.10+ds-1~deb11u1trafficserver-dbgsym_8.1.10+ds-1~deb11u1_mips64el.deb
Debian11mips64eltrafficserver-experimental-plugins-dbgsym< 8.1.10+ds-1~deb11u1trafficserver-experimental-plugins-dbgsym_8.1.10+ds-1~deb11u1_mips64el.deb
Debian10alltrafficserver< 8.1.7-0+deb10u4trafficserver_8.1.7-0+deb10u4_all.deb
Debian10i386trafficserver-experimental-plugins-dbgsym< 8.1.7-0+deb10u4trafficserver-experimental-plugins-dbgsym_8.1.7-0+deb10u4_i386.deb
Debian10arm64trafficserver< 8.1.7-0+deb10u4trafficserver_8.1.7-0+deb10u4_arm64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	amd64	trafficserver-dev	< 8.1.10+ds-1~deb11u1	trafficserver-dev_8.1.10+ds-1~deb11u1_amd64.deb
Debian	11	i386	trafficserver	< 8.1.10+ds-1~deb11u1	trafficserver_8.1.10+ds-1~deb11u1_i386.deb
Debian	11	armhf	trafficserver-experimental-plugins	< 8.1.10+ds-1~deb11u1	trafficserver-experimental-plugins_8.1.10+ds-1~deb11u1_armhf.deb
Debian	11	ppc64el	trafficserver-experimental-plugins	< 8.1.10+ds-1~deb11u1	trafficserver-experimental-plugins_8.1.10+ds-1~deb11u1_ppc64el.deb
Debian	11	armhf	trafficserver-dbgsym	< 8.1.10+ds-1~deb11u1	trafficserver-dbgsym_8.1.10+ds-1~deb11u1_armhf.deb
Debian	11	mips64el	trafficserver-dbgsym	< 8.1.10+ds-1~deb11u1	trafficserver-dbgsym_8.1.10+ds-1~deb11u1_mips64el.deb
Debian	11	mips64el	trafficserver-experimental-plugins-dbgsym	< 8.1.10+ds-1~deb11u1	trafficserver-experimental-plugins-dbgsym_8.1.10+ds-1~deb11u1_mips64el.deb
Debian	10	all	trafficserver	< 8.1.7-0+deb10u4	trafficserver_8.1.7-0+deb10u4_all.deb
Debian	10	i386	trafficserver-experimental-plugins-dbgsym	< 8.1.7-0+deb10u4	trafficserver-experimental-plugins-dbgsym_8.1.7-0+deb10u4_i386.deb
Debian	10	arm64	trafficserver	< 8.1.7-0+deb10u4	trafficserver_8.1.7-0+deb10u4_arm64.deb