CVE-2023-30631
Assigner: apache
Published: 2023-06-14T07:44:55.149Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Traffic Server
vendor: Apache Software Foundation
versions: lessThanOrEqual: 9.2.0
status: affected
version: 8.0.0
versionType: semver
credits: type: finder
value: Chris Lemmons
descriptions: supportingMedia: base64: no
type: text/html
value: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.&nbsp; The configuration option&nbsp;proxy.config.http.push_method_enabled didn't function.&nbsp; However, by default the PUSH method is blocked in the ip_allow configuration file.<p>This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.</p><p>8.x users should upgrade to 8.1.7 or later versions<br>9.x users should upgrade to 9.2.1 or later versions<br></p>
value: Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.  The configuration option proxy.config.http.push_method_enabled didn't function.  However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.

8.x users should upgrade to 8.1.7 or later versions
9.x users should upgrade to 9.2.1 or later versions



metrics: other: content: text: moderate
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-20
description: CWE-20 Improper Input Validation
type: CWE
source: discovery: UNKNOWN
title: Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work
x_generator: engine: Vulnogram 0.1.0-dev