HIGH
Insufficient Validation of HTTP/1.x Headers
Published Aug 10, 2022
7.5
HIGHCVSS 3.1
EPSS 2.37%
Description
Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Affected products
-
- Version 8.0.0 to 9.1.2StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Traffic Server | n/a |
|
Configuration 1
OR
- ≥ 8.0.0 · ≤ 8.1.4
- ≥ 9.0.0 · ≤ 9.1.2
Configuration 2
OR
- 10.0
- 11.0
Configuration 3
OR
- 35
- 36
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (6)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-32611 Advisory
- https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21 Mailing ListVendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00019.html mailing-listMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3UMS2UF4X4J/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCSBQBYPOZSWS5LCOAQ6LJLRLXFIAW5A/ vendor-advisory
- https://www.debian.org/security/2022/dsa-5206 vendor-advisoryThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-32611 | Advisory | |
| https://lists.apache.org/thread/rc64lwbdgrkv674koc3zl1sljr9vwg21 | Mailing ListVendor Advisory | |
| https://lists.debian.org/debian-lts-announce/2023/01/msg00019.html | mailing-listMailing ListThird Party Advisory | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJ67IWD5PRJUOIYIDJRUG3UMS2UF4X4J/ | vendor-advisory | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCSBQBYPOZSWS5LCOAQ6LJLRLXFIAW5A/ | vendor-advisory | |
| https://www.debian.org/security/2022/dsa-5206 | vendor-advisoryThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apache
Published Aug 10, 2022
Updated Aug 3, 2024
Reserved Mar 28, 2022
Link CVE-2022-28129
CISA Vulnrichment
Updated n/a
ENISA EUVD
EUVD-2022-32611 Assigner apache
Published Aug 10, 2022
Updated Aug 3, 2024
Exploited since n/a
Link EUVD-2022-32611