[SECURITY] [DSA 5311-1] trafficserver security update

2023-01-0818:57:53

lists.debian.org

trafficserver

cve-2022-32749

cve-2022-37392

http request smuggling

cache poisoning

denial of service

debian bullseye

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.5%

JSON

Debian Security Advisory DSA-5311-1 [email protected]
https://www.debian.org/security/ Moritz Muehlenhoff
January 08, 2023 https://www.debian.org/security/faq

Package : trafficserver
CVE ID : CVE-2022-32749 CVE-2022-37392

Several vulnerabilities were discovered in Apache Traffic Server, a
reverse and forward proxy server, which could result in HTTP request
smuggling, cache poisoning or denial of service.

For the stable distribution (bullseye), these problems have been fixed in
version 8.1.6+ds-1~deb11u1.

We recommend that you upgrade your trafficserver packages.

For the detailed security status of trafficserver please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/trafficserver

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian10arm64trafficserver< 8.1.6+ds-1~deb10u1trafficserver_8.1.6+ds-1~deb10u1_arm64.deb
Debian10arm64trafficserver-experimental-plugins< 8.1.6+ds-1~deb10u1trafficserver-experimental-plugins_8.1.6+ds-1~deb10u1_arm64.deb
Debian11amd64trafficserver-dbgsym< 8.1.6+ds-1~deb11u1trafficserver-dbgsym_8.1.6+ds-1~deb11u1_amd64.deb
Debian11armhftrafficserver-dev< 8.1.6+ds-1~deb11u1trafficserver-dev_8.1.6+ds-1~deb11u1_armhf.deb
Debian10amd64trafficserver-experimental-plugins< 8.1.6+ds-1~deb10u1trafficserver-experimental-plugins_8.1.6+ds-1~deb10u1_amd64.deb
Debian11ppc64eltrafficserver-dbgsym< 8.1.6+ds-1~deb11u1trafficserver-dbgsym_8.1.6+ds-1~deb11u1_ppc64el.deb
Debian11arm64trafficserver-experimental-plugins< 8.1.6+ds-1~deb11u1trafficserver-experimental-plugins_8.1.6+ds-1~deb11u1_arm64.deb
Debian11mips64eltrafficserver-dbgsym< 8.1.6+ds-1~deb11u1trafficserver-dbgsym_8.1.6+ds-1~deb11u1_mips64el.deb
Debian11i386trafficserver-experimental-plugins-dbgsym< 8.1.6+ds-1~deb11u1trafficserver-experimental-plugins-dbgsym_8.1.6+ds-1~deb11u1_i386.deb
Debian11ppc64eltrafficserver-experimental-plugins< 8.1.6+ds-1~deb11u1trafficserver-experimental-plugins_8.1.6+ds-1~deb11u1_ppc64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	arm64	trafficserver	< 8.1.6+ds-1~deb10u1	trafficserver_8.1.6+ds-1~deb10u1_arm64.deb
Debian	10	arm64	trafficserver-experimental-plugins	< 8.1.6+ds-1~deb10u1	trafficserver-experimental-plugins_8.1.6+ds-1~deb10u1_arm64.deb
Debian	11	amd64	trafficserver-dbgsym	< 8.1.6+ds-1~deb11u1	trafficserver-dbgsym_8.1.6+ds-1~deb11u1_amd64.deb
Debian	11	armhf	trafficserver-dev	< 8.1.6+ds-1~deb11u1	trafficserver-dev_8.1.6+ds-1~deb11u1_armhf.deb
Debian	10	amd64	trafficserver-experimental-plugins	< 8.1.6+ds-1~deb10u1	trafficserver-experimental-plugins_8.1.6+ds-1~deb10u1_amd64.deb
Debian	11	ppc64el	trafficserver-dbgsym	< 8.1.6+ds-1~deb11u1	trafficserver-dbgsym_8.1.6+ds-1~deb11u1_ppc64el.deb
Debian	11	arm64	trafficserver-experimental-plugins	< 8.1.6+ds-1~deb11u1	trafficserver-experimental-plugins_8.1.6+ds-1~deb11u1_arm64.deb
Debian	11	mips64el	trafficserver-dbgsym	< 8.1.6+ds-1~deb11u1	trafficserver-dbgsym_8.1.6+ds-1~deb11u1_mips64el.deb
Debian	11	i386	trafficserver-experimental-plugins-dbgsym	< 8.1.6+ds-1~deb11u1	trafficserver-experimental-plugins-dbgsym_8.1.6+ds-1~deb11u1_i386.deb
Debian	11	ppc64el	trafficserver-experimental-plugins	< 8.1.6+ds-1~deb11u1	trafficserver-experimental-plugins_8.1.6+ds-1~deb11u1_ppc64el.deb