CVE-2022-31780: HTTP/2 framing vulnerabilities
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.5+ds-0+deb12u4 - Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.1.3+ds-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31780?
CVE-2022-31780 has been rated as a critical severity vulnerability due to its potential to enable request smuggling attacks.
What versions of Apache Traffic Server are affected by CVE-2022-31780?
CVE-2022-31780 affects Apache Traffic Server versions from 8.0.0 up to 9.1.2 inclusive.
How do I fix CVE-2022-31780?
To fix CVE-2022-31780, upgrade Apache Traffic Server to a patched version such as 8.1.7 or 9.2.0 and above.
What type of vulnerability is CVE-2022-31780?
CVE-2022-31780 is classified as an improper input validation vulnerability impacting HTTP/2 frame handling.
Can CVE-2022-31780 affect other operating systems besides Debian?
Yes, CVE-2022-31780 can also affect the Fedora operating system versions 35 and 36.