CVE-2022-31779: Improper HTTP/2 scheme and method validation
Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.5+ds-0+deb12u4 - Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.1.3+ds-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31779?
CVE-2022-31779 is classified as a medium severity vulnerability due to its potential for request smuggling attacks.
How do I fix CVE-2022-31779?
To fix CVE-2022-31779, upgrade Apache Traffic Server to version 8.1.7 or later, or 9.2.0 or later.
What versions of Apache Traffic Server are affected by CVE-2022-31779?
CVE-2022-31779 affects Apache Traffic Server versions from 8.0.0 up to and including 9.1.2.
Can CVE-2022-31779 impact my Apache server configuration?
Yes, CVE-2022-31779 can impact Apache server configurations by allowing attackers to smuggle HTTP requests.
Is CVE-2022-31779 specific to certain operating systems?
CVE-2022-31779 affects Apache Traffic Server on various operating systems, including Debian and Fedora.