CVE-2022-25763

Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

References

Affected packages

Git / github.com/apache/trafficserver

Affected ranges

Type

GIT

Repo

https://github.com/apache/trafficserver

Events

Introduced

b310e3566f58dd04ec2b15b111ec86ea70e20019

Fixed

b4393bc5aca5ac3b6f339722457a0ebd4dbf5517

Introduced

b14030656330ed623cd1f9efe2f4f9abd9d16e29

Fixed

30e5bdb03dea1492caf569a1af57eef647ee076c

Database specific

{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.1.5"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.1.3"
        }
    ]
}

Affected versions

8.*

8.0.0

8.0.0-rc4

8.0.1

8.0.1-rc0

8.0.2

8.0.2-rc0

8.0.3

8.0.3-rc0

8.0.4

8.0.4-rc0

8.0.5

8.0.6

8.0.6-rc0

8.0.6-rc1

8.1.0

8.1.0-rc0

8.1.1

8.1.1-rc0

8.1.2-rc0

8.1.3

8.1.3-rc0

8.1.3-rc1

8.1.4

8.1.4-rc0

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "35"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "36"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-25763.json"