This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Apache Traffic Server fixes 4 vulnerabilities
Apache fixes 4 vulnerabilities in Apache Traffic Server with versions 10.0.4 and 9.2.9 [1].
Due to improper input validation in the processing of pipelining after a chunked message body, an authenticated remote attacker can send a forged request to the server and bypass security measures [1][2].
The vulnerability is present in product:
- *:Apache Traffic Server;>=8.0.0,<=8.1.11;>=9.0.0,<=9.2.8;>=10.0.0,<=10.0.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
More information:
- CVE-2024-38311 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 6. 3. 2025.
Due to insufficient access validation of intercept plugins on the server, an authenticated remote attacker can potentially perform unauthorized operations [1][3][4].
The vulnerability is present in product:
- *:Apache Traffic Server;>=9.0.0,<=9.2.8;>=10.0.0,<=10.0.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
More information:
- CVE-2024-56195 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 6. 3. 2025.
Due to the incompatibility of some Access Control Lists (ACLs) with older versions, an authenticated remote attacker can potentially gain unauthorized access [1][5].
The vulnerability is present in product:
- *:Apache Traffic Server;>=10.0.0,<=10.0.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
More information:
- CVE-2024-56196 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 6. 3. 2025.
Due to improper handling of the Expect header, an authenticated remote attacker can over-allocate system resources and potentially perform a DoS attack [1][6][7].
The vulnerability is present in product:
- *:Apache Traffic Server;>=9.0.0,<=9.2.8;>=10.0.0,<=10.0.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2024-56202 at cve.org, NVD
- CWE-440: Expected Behavior Violation at cwe.mitre.org
The vulnerability was publicly disclosed 6. 3. 2025.
Links
- [1] https://lists.apache.org/thread/btofzws2yqskk2n7f01r3l1819x01023
- [2] https://nvd.nist.gov/vuln/detail/CVE-2024-38311
- [3] https://nvd.nist.gov/vuln/detail/CVE-2024-56195
- [4] https://docs.trafficserver.apache.org/en/latest/developer-guide/plugins/hooks-and-transactions/intercepting-http-transactions.en.html
- [5] https://nvd.nist.gov/vuln/detail/CVE-2024-56196
- [6] https://nvd.nist.gov/vuln/detail/CVE-2024-56202
- [7] https://docs.trafficserver.apache.org/en/8.1.x/appendices/faq.en.html#support-for-http-expect-header
By CESNET, z.s.p.o. Michaela Ručková on 7. 3. 2025.