CVE-2023-30631
published 2023-06-14CVE-2023-30631: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.push_method_enabled…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.00%
78.6th percentile
Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.push_method_enabled didn't function. However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.
8.x users should upgrade to 8.1.7 or later versions
9.x users should upgrade to 9.2.1 or later versions
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | traffic_server | >= 8.0.0 < 8.1.7 | 8.1.7 |
| apache | traffic_server | >= 9.0.0 < 9.2.1 | 9.2.1 |
| apache_software_foundation | apache_traffic_server | 8.0.0 – 9.2.0 | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | trafficserver | < trafficserver 9.2.0+ds-2+deb12u1 (bookworm) | trafficserver 9.2.0+ds-2+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2023-30631: trafficserver - Improper Input Validation vulnerability in Apache Software Foundation Apache Tra...
vendor_debian·2023·CVSS 7.5
CVE-2023-30631 [HIGH] CVE-2023-30631: trafficserver - Improper Input Validation vulnerability in Apache Software Foundation Apache Tra...
Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.push_method_enabled didn't function. However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
Scope: local
bookworm: resolved (fixed in 9.2.0+ds-2+deb12u1)
bullseye: resolved (fixed in 8.1.7+ds-1~deb11u1)
sid: resolved (fixed in 9.2.1+ds-1)
GHSA
GHSA-5rc2-qffv-3c8p: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server
ghsa_unreviewed·2023-06-14
CVE-2023-30631 [HIGH] CWE-20 GHSA-5rc2-qffv-3c8p: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server
Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.push_method_enabled didn't function. However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.
8.x users should upgrade to 8.1.7 or later versions
9.x users should upgrade to 9.2.1 or later versions
OSV
CVE-2023-30631: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server
osv·2023-06-14·CVSS 7.5
CVE-2023-30631 [HIGH] CVE-2023-30631: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server
Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.push_method_enabled didn't function. However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
OSV
golang-1.18 vulnerabilities
osv·2023-04-25·CVSS 6.5
CVE-2022-1705 golang-1.18 vulnerabilities
golang-1.18 vulnerabilities
It was discovered that the Go net/http module incorrectly handled
Transfer-Encoding headers in the HTTP/1 client. A remote attacker could
possibly use this issue to perform an HTTP Request Smuggling attack.
(CVE-2022-1705)
It was discovered that Go did not properly manage memory under certain
circumstances. An attacker could possibly use this issue to cause a panic
resulting into a denial of service. (CVE-2022-1962, CVE-2022-27664,
CVE-2022-28131, CVE-2022-30630, CVE-2022-30631, CVE-2022-30632,
CVE-2022-30633, CVE-2022-30635, CVE-2022-32189, CVE-2022-41715,
CVE-2022-41717, CVE-2023-24534, CVE-2023-24537)
It was discovered that Go did not properly implemented the maximum size of
file headers in Reader.Read. An attacker could possibly use this issue to
cause a
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://lists.apache.org/thread/tns2b4khyyncgs5v5p9y35pobg9z2bvshttps://lists.debian.org/debian-lts-announce/2023/06/msg00037.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/6GDCBNFDDW6ULW7CACJCPENI7BVDHM5O/https://lists.fedoraproject.org/archives/list/[email protected]/message/FGWXNAEEVRUZ5JG4EJAIIFC3CI7LFETV/https://www.debian.org/security/2023/dsa-5435https://lists.apache.org/thread/tns2b4khyyncgs5v5p9y35pobg9z2bvshttps://lists.debian.org/debian-lts-announce/2023/06/msg00037.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/6GDCBNFDDW6ULW7CACJCPENI7BVDHM5O/https://lists.fedoraproject.org/archives/list/[email protected]/message/FGWXNAEEVRUZ5JG4EJAIIFC3CI7LFETV/https://www.debian.org/security/2023/dsa-5435
2023-06-14
Published