CVE-2024-35161criticalCWE-444

CVE-2024-35161: fallo crítico en Apache Traffic Server

Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Traffic Server+ Monitorear trafficserver

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 1.0%
Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked trailer section. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Apache Software Foundation · Apache Traffic Server
CVEs relacionadas — Apache Traffic Server

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-31309HIGHApache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attackEPSS 94.6%CVE-2023-39456HIGHApache Traffic Server: Malformed http/2 frames can cause an abortEPSS 58.3%CVE-2018-1318—CVE-2018-1318EPSS 7.7%CVE-2018-8022—CVE-2018-8022EPSS 7.5%CVE-2018-8040—CVE-2018-8040EPSS 7.2%CVE-2018-8005—CVE-2018-8005EPSS 6.9%