CVE-2024-31309

2024-04-1012:15:09

Debian Security Bug Tracker

security-tracker.debian.org

apache traffic server

http/2

dos attack

fix

upgrade

limit

memory

unix

7.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.3%

JSON

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.

OSVersionArchitecturePackageVersionFilename
Debian12alltrafficserver< 9.2.4+ds-0+deb12u1trafficserver_9.2.4+ds-0+deb12u1_all.deb
Debian11alltrafficserver< 8.1.10+ds-1~deb11u1trafficserver_8.1.10+ds-1~deb11u1_all.deb
Debian10alltrafficserver< 8.1.7-0+deb10u4trafficserver_8.1.7-0+deb10u4_all.deb
Debian999alltrafficserver< 9.2.4+ds-1trafficserver_9.2.4+ds-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	trafficserver	< 9.2.4+ds-0+deb12u1	trafficserver_9.2.4+ds-0+deb12u1_all.deb
Debian	11	all	trafficserver	< 8.1.10+ds-1~deb11u1	trafficserver_8.1.10+ds-1~deb11u1_all.deb
Debian	10	all	trafficserver	< 8.1.7-0+deb10u4	trafficserver_8.1.7-0+deb10u4_all.deb
Debian	999	all	trafficserver	< 9.2.4+ds-1	trafficserver_9.2.4+ds-1_all.deb