CVE-2023-30631CWE-20

Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work

published June 14, 2023

CVSS
—
EPSS
2%
Percentile
80.6
In the wild
Unconfirmed
What it is

Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.  The configuration option proxy.config.http.push_method_enabled didn't function.  However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.

8.x users should upgrade to 8.1.7 or later versions

9.x users should upgrade to 9.2.1 or later versions

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02005 · 80.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-06-14T07:44Z
EPSS history
Timeline
  • 14 JUN 07:44Z
    Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work
    cvelistv5