Apache Traffic Server 输入验证错误漏洞

Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation. Apache Traffic Server is vulnerable to an input validation error, which could be exploited by attackers to smuggle requests...

PT-2022-10635 · Apache · Apache Traffic Server

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 9.1.2 Description: The issue is related to improper input validation in the header parsing of Apache Traffic Server, allowing an attacker to request secure resources. Recommendations: For Apache...

Apache Traffic Server 输入验证错误漏洞

Apache Traffic Server ATS or TS is a high-performance, modular HTTP proxy and caching server, similar to Nginx and Squid. Traffic Server was originally a commercial product of Inktomi, a company acquired by Yahoo in 2003, and in August 2009 Yahoo contributed the source code to the In August 2009...

PT-2022-18829

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 9.1.2 Description The issue is related to improper input validation in HTTP/1.1 header parsing, allowing an attacker to send invalid headers. Recommendations For Apache Traffic Server versions 8.0.0...

CVE-2022-28129 Insufficient Validation of HTTP/1.x Headers

Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2...

CVE-2022-31778 Transfer-Encoding not treated as hop-by-hop

Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2...

CVE-2022-31780 HTTP/2 framing vulnerabilities

Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2...

CVE-2022-28129 Insufficient Validation of HTTP/1.x Headers

Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2...

CVE-2021-37150 Protocol vs scheme mismatch

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2...

CVE-2022-31780

CVE-2022-31780 affects Apache Traffic Server (8.0.0–9.1.2) with an improper input validation in HTTP/2 frame handling that can allow request smuggling. Connected advisories confirm fixes: Debian DLA-3279 (trafficserver 8.0.2+ds-1+deb10u7) and Fedora updates (trafficserver 9.1.3-1.fc36/1.fc35). Op...

CVE-2022-31778

Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2...

CVE-2022-31780

Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2...

CVE-2021-37150

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to request secure resources. This issue affects Apache Traffic Server 8.0.0 to 9.1.2...

Apache Traffic Server 环境问题漏洞

Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation. version 8.0.0 to 9.1.2 of Apache Traffic Server has an input validation error vulnerability that could be exploited by attackers to create smuggling or cache poisoning attacks...

CVE-2022-31780 HTTP/2 framing vulnerabilities

Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2...

Debian DSA-5153-1 : trafficserver - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5153 advisory. Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server, which could result in HTTP request smuggling or MITM...

Improper Input Validation

Apache Traffic Server is using Improper Input Validation. Lack of proper validation in request line parsing of Apache Traffic Server allows an attacker to send invalid requests...

Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter...

GHSA-MG2C-RC36-P594 Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter...

GHSA-F2WR-C4C4-XJG7 Apache Traffic Control vulnerable to Slowloris-style Denial of Service attack

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is...