CVE-2023-39456

CWE-20 — Improper Input Validation5 documents5 sources

Severity

7.5HIGH

EPSS

7.3%

top 8.30%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Traffic Server Apache Software Foundation Apache Traffic Server Fedoraproject Fedora

Timeline

PublishedOct 17

Description

Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. Users are recommended to upgrade to version 9.2.3, which fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/traffic_server9.0.0 — 9.2.3

▶CVEListV5apache_software_foundation/apache_traffic_server9.0.0 — 9.2.2

▶Debiantrafficserver< 9.2.3+ds-1+deb12u1

Also affects: Fedora 37, 38

🔴Vulnerability Details

OSV

CVE-2023-39456: Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames↗2023-10-17

▶

CVEList

Apache Traffic Server: Malformed http/2 frames can cause an abort↗2023-10-17

▶

GHSA

GHSA-fr7h-j3xj-fvvv: Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames↗2023-10-17

▶

📋Vendor Advisories

Debian

CVE-2023-39456: trafficserver - Improper Input Validation vulnerability in Apache Traffic Server with malformed ...↗2023

▶