Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work
CVE-2023-30631

7.5HIGH

Key Information:

Vendor
Apache
Status
Apache Traffic Server
Vendor
CVE Published:
14 June 2023

Summary

An improper input validation flaw exists in Apache Traffic Server due to the malfunction of the configuration option 'proxy.config.http.push_method_enabled'. By default, the PUSH method is restricted within the ip_allow configuration file, but the ineffective validation poses a potential risk. Users of Apache Traffic Server versions 8.0.0 through 9.2.0 are advised to upgrade: 8.x users should move to version 8.1.7 or later, while 9.x users should upgrade to version 9.2.1 or newer.

Affected Version(s)

Apache Traffic Server 8.0.0 <= 9.2.0

References

https://lists.apache.org/thread/tns2b4khyyncgs5v5p9y35pob...
vendor-advisory
https://www.debian.org/security/2023/dsa-5435
https://lists.fedoraproject.org/archives/list/package-ann...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chris Lemmons
.