CVE-2024-38479 — Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack

CVE-2024-38479

Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack PUBLISHED

Description (CNA)

Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Traffic Server	affected 8.0.0 through 8.1.11; affected 9.0.0 through 9.2.5

CWE

CWE-20

References

https://lists.apache.org/thread/y15fh6c7kyqvzm0f9odw7c5jh4r4np0y

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://lists.debian.org/debian-lts-announce/2025/02/msg00018.html