CVE-2022-31780: HTTP/2 framing vulnerabilities
Published Aug 10, 2022
·Updated
Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Affected Software
7 affected componentsFixes available
debian/trafficserver<=8.0.2+ds-1+deb10u6
8.1.7-0+deb10u28.1.7+ds-1~deb11u19.2.0+ds-2+deb12u19.2.2+ds-1
Apache Traffic Server>=8.0.0<=8.1.4
Apache Traffic Server>=9.0.0<=9.1.2
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Fedoraproject Fedora=35
Fedoraproject Fedora=36
Event History
Aug 10, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-31780?
CVE-2022-31780 has been rated as a critical severity vulnerability due to its potential to enable request smuggling attacks.
2
What versions of Apache Traffic Server are affected by CVE-2022-31780?
CVE-2022-31780 affects Apache Traffic Server versions from 8.0.0 up to 9.1.2 inclusive.
3
How do I fix CVE-2022-31780?
To fix CVE-2022-31780, upgrade Apache Traffic Server to a patched version such as 8.1.7 or 9.2.0 and above.
4
What type of vulnerability is CVE-2022-31780?
CVE-2022-31780 is classified as an improper input validation vulnerability impacting HTTP/2 frame handling.
5
Can CVE-2022-31780 affect other operating systems besides Debian?
Yes, CVE-2022-31780 can also affect the Fedora operating system versions 35 and 36.