CVE-2023-38522: Apache Traffic Server: Incomplete field name check allows request smuggling
Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.
Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.5+ds-0+deb12u4 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 8.1.11 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.5
Event History
Frequently Asked Questions
What is the severity of CVE-2023-38522?
CVE-2023-38522 has a high severity rating due to potential risks of request smuggling and cache poisoning.
How do I fix CVE-2023-38522?
To fix CVE-2023-38522, upgrade Apache Traffic Server to version 8.1.11 or 9.2.5 or later.
What impact does CVE-2023-38522 have on affected systems?
CVE-2023-38522 can allow attackers to exploit the server by sending malformed HTTP requests leading to cache poisoning.
Which versions of Apache Traffic Server are affected by CVE-2023-38522?
Apache Traffic Server versions from 8.0.0 to 8.1.11 and 9.0.0 to 9.2.5 are affected by CVE-2023-38522.
Is CVE-2023-38522 related to other vulnerabilities?
CVE-2023-38522 can be exploited in conjunction with vulnerabilities in origin servers if they are also susceptible to manipulation.