CVE-2024-35161 — Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling

Description (CNA)

Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users can set a new setting (proxy.config.http.drop_chunked_trailers) not to forward chunked trailer section. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Traffic Server	affected 8.0.0 through 8.1.10; affected 9.0.0 through 9.2.4

CWE

CWE-444

References

https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0
https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html