CVE-2022-31779: Improper HTTP/2 scheme and method validation
Published Aug 10, 2022
·Updated
Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Affected Software
6 affected componentsFixes available
debian/trafficserver<=8.0.2+ds-1+deb10u6
8.1.7-0+deb10u28.1.7+ds-1~deb11u19.2.0+ds-2+deb12u19.2.2+ds-1
Apache Traffic Server>=8.0.0<=8.1.4
Apache Traffic Server>=9.0.0<=9.1.2
Debian Debian Linux=11.0
Fedoraproject Fedora=35
Fedoraproject Fedora=36
Event History
Aug 10, 2022
CVE Published
via MITRE·05:50 AM
Data Sourced
via MITRE·05:50 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-31779?
CVE-2022-31779 is classified as a medium severity vulnerability due to its potential for request smuggling attacks.
2
How do I fix CVE-2022-31779?
To fix CVE-2022-31779, upgrade Apache Traffic Server to version 8.1.7 or later, or 9.2.0 or later.
3
What versions of Apache Traffic Server are affected by CVE-2022-31779?
CVE-2022-31779 affects Apache Traffic Server versions from 8.0.0 up to and including 9.1.2.
4
Can CVE-2022-31779 impact my Apache server configuration?
Yes, CVE-2022-31779 can impact Apache server configurations by allowing attackers to smuggle HTTP requests.
5
Is CVE-2022-31779 specific to certain operating systems?
CVE-2022-31779 affects Apache Traffic Server on various operating systems, including Debian and Fedora.