CVE-2022-32749
Published: 19 December 2022
Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions. This issue affects Apache Traffic Server: from 8.0.0 through 9.1.3.
Priority
Status
Package | Release | Status |
---|---|---|
trafficserver Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
focal |
Needs triage
|
|
jammy |
Needs triage
|
|
kinetic |
Ignored
(end of life, was needs-triage)
|
|
lunar |
Ignored
(end of life, was needs-triage)
|
|
mantic |
Not vulnerable
(9.2.0+ds-2)
|
|
trusty |
Ignored
(end of standard support)
|
|
upstream |
Released
(9.1.4+ds-1)
|
|
xenial |
Needs triage
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.5 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
- https://lists.apache.org/thread/mrj2lg4s0hf027rk7gz8t7hbn9xpfg02
- https://github.com/apache/trafficserver/pull/9243
- https://github.com/apache/trafficserver/commit/71a80d1abb3fbcb2e30ff850c8bca0a371589b5a (master)
- https://github.com/apache/trafficserver/commit/590f87304b233791169af3d5899c5ba135bb61fa (9.1.x)
- https://www.cve.org/CVERecord?id=CVE-2022-32749
- NVD
- Launchpad
- Debian