CVE-2022-31778: Transfer-Encoding not treated as hop-by-hop

Q: What is the vulnerability ID for this vulnerability?

The vulnerability ID is CVE-2022-31778.

Q: What is the severity of CVE-2022-31778?

The severity of CVE-2022-31778 is high with a score of 7.5.

Q: How does CVE-2022-31778 affect Apache Traffic Server?

CVE-2022-31778 affects Apache Traffic Server versions 8.0.0 to 9.0.2.

Q: How can an attacker exploit CVE-2022-31778?

An attacker can exploit CVE-2022-31778 by poisoning the cache through improper input validation in handling the Transfer-Encoding header of Apache Traffic Server.

Q: How can I fix CVE-2022-31778?

To fix CVE-2022-31778, update Apache Traffic Server to versions 8.1.7 or 9.2.2 or higher.

Published Aug 10, 2022

Updated

Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2.

Affected Software

5 affected componentsFixes available

Apache Traffic Server>=8.0.0<=8.1.4

Apache Traffic Server>=9.0.0<=9.1.2

Debian Debian Linux=11.0

debian/trafficserver<9.1.3+ds-1

9.1.3+ds-1

debian/trafficserver

9.2.5+ds-0+deb12u4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/trafficserver to a version that resolves this vulnerability.
Fixed in 9.2.5+ds-0+deb12u4
Upgrade
Upgrade debian/trafficserver to a version that resolves this vulnerability.
Fixed in 9.1.3+ds-1

Event History

Aug 10, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via OSV·06:15 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-5206

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3385-1

Frequently Asked Questions

What is the vulnerability ID for this vulnerability?