This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Apache Traffic Server fixes 3 vulnerabilities
Apache fixes 3 vulnerabilities in Apache Traffic Server in versions 10.0.2 and 9.2.6 [1].
An unauthenticated remote attacker can serve forged data to victims by poisoning the cache [1][2].
The vulnerability is present in product:
- Apache Traffic Server; >=9, <9.2.5;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
More information:
- CVE-2024-38479 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
An unauthenticated remote attacker can carry out a DoS attack on the affected machine by sending specially crafted HTTP requests [1][3].
The vulnerability is present in product:
- Apache Traffic Server; >=9, <9.2.5;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-50305 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
An unauthenticated remote attacker can potentially abuse the privileges of the ATS process, which may be higher than originally intended [1][4].
The vulnerability is present in product:
- Apache Traffic Server; >=9, <9.2.6; >=10, <10.0.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
More information:
- CVE-2024-50306 at cve.org, NVD
- CWE-252: Unchecked Return Value at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 18. 11. 2024.