CVE-2023-30631

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.pushmethodenabled didn't function. However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.

8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions

References

Affected packages

Git / github.com/apache/trafficserver

Affected ranges

Type

GIT

Repo

https://github.com/apache/trafficserver

Events

Introduced

b310e3566f58dd04ec2b15b111ec86ea70e20019

Fixed

005a6ce785df717b2bf565dc07b66b4f918c024c

Introduced

b14030656330ed623cd1f9efe2f4f9abd9d16e29

Fixed

c0402b7f021092a8fef885d78ec2608a8bd3f375

Introduced

Last affected

3fa146678bc6a061722f4ea930998ae29ad70de3

Database specific

{
    "versions": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.1.7"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.2.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.0"
        }
    ]
}

Affected versions

10.*

10.0.0

10.0.0-rc0

10.1.0

10.1.0-rc0

10.1.0-rc1

10.1.1

10.1.1-rc0

10.1.1-rc1

10.1.2-rc0

2.*

2.0.0

2.0.0-alpha

2.0.1

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.2.0

3.2.1

3.2.2

3.2.4

3.2.5

3.3.0

3.3.1

3.3.2

3.3.3

3.3.4

3.3.5

4.*

4.0.0

4.0.1

4.0.2

4.1.0

4.1.1

4.1.2

4.1.2-rc0

4.2.0

4.2.0-rc0

4.2.0-rc1

4.2.1

4.2.1-rc0

4.2.1-rc1

4.2.1.1

4.2.2

4.2.2-rc0

4.2.3

4.2.3-rc0

5.*

5.0.0

5.0.0-rc0

5.0.0-rc1

5.0.0-rc2

5.0.1

5.1.0

5.1.0-rc0

5.1.0-rc1

5.1.1

5.1.2

5.1.2-rc0

5.2.0

5.2.0-rc0

5.2.0-rc1

5.2.0-rc2

5.2.0-rc3

5.2.0-rc4

5.2.0-rc5

5.2.1

5.2.1-rc0

5.2.1-rc1

5.3.0

5.3.0-rc0

5.3.0-rc1

5.3.0-rc2

5.3.0-rc3

5.3.1

5.3.1-rc0

5.3.2

5.3.2-rc0

5.3.2-rc1

6.*

6.0.0

6.0.0-rc0

6.0.0-rc1

6.0.0-rc2

6.0.0-rc3

6.0.1-rc0

6.0.1-rc1

6.1.0

6.1.0-rc0

6.1.0-rc1

6.1.0-rc2

6.1.1

6.1.1-rc0

6.2.0

6.2.0-rc0

6.2.0-rc1

6.2.0-rc2

6.2.0-rc3

6.2.1

6.2.1-rc0

6.2.2

6.2.2-rc0

6.2.3

6.2.3-rc0

7.*

7.0.0

7.0.0-rc0

7.0.0-rc1

7.0.0-rc2

7.1.0

7.1.0-rc0

7.1.0-rc1

7.1.1

7.1.1-rc0

7.1.1-rc1

7.1.10

7.1.10-rc0

7.1.11

7.1.11-rc0

7.1.12

7.1.12-rc0

7.1.2

7.1.2-rc0

7.1.2-rc1

7.1.2-rc2

7.1.2-rc3

7.1.2-rc4

7.1.3

7.1.3-rc0

7.1.4

7.1.4-rc0

7.1.4-rc1

7.1.5

7.1.5-rc0

7.1.5-rc1

7.1.6

7.1.6-rc0

7.1.6-rc1

7.1.7

7.1.7-rc0

7.1.8

7.1.9

7.1.9-rc0

7.1.9-rc1

7.1.9-rc2

8.*

8.0.0

8.0.0-rc0

8.0.0-rc1

8.0.0-rc2

8.0.0-rc3

8.0.0-rc4

8.0.1

8.0.1-rc0

8.0.2

8.0.2-rc0

8.0.3

8.0.3-rc0

8.0.4

8.0.4-rc0

8.0.5

8.0.6

8.0.6-rc0

8.0.6-rc1

8.0.7

8.0.7-rc0

8.0.8

8.0.8-rc0

8.1.0

8.1.0-rc0

8.1.1

8.1.1-rc0

8.1.2-rc0

8.1.3

8.1.3-rc0

8.1.3-rc1

8.1.4

8.1.4-rc0

8.1.5

8.1.5-rc0

8.1.6

8.1.6-rc0

9.*

9.0.0

9.0.0-rc0

9.0.0-rc1

9.0.1

9.0.1-rc0

9.0.1-rc1

9.0.2

9.0.2-rc0

9.1.0

9.1.0-rc0

9.1.1

9.1.1-rc0

9.1.1-rc1

9.1.1-rc2

9.1.2

9.1.2-rc0

9.1.2-rc1

9.1.3

9.1.3-rc0

9.1.4-rc0

9.2.0-rc0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30631.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "37"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "38"
            }
        ]
    }
]