Unrated severityNVD Advisory· Published Jun 14, 2023· Updated Feb 13, 2025
Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work
CVE-2023-30631
Description
Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.push_method_enabled didn't function. However, by default the PUSH method is blocked in the ip_allow configuration file.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.
8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2>=8.0.0, <=9.2.0+ 1 more
- (no CPE)range: >=8.0.0, <=9.2.0
- (no CPE)range: 8.0.0
Patches
Vulnerability mechanics
References
5- lists.apache.org/thread/tns2b4khyyncgs5v5p9y35pobg9z2bvsmitrevendor-advisory
- lists.debian.org/debian-lts-announce/2023/06/msg00037.htmlmitre
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6GDCBNFDDW6ULW7CACJCPENI7BVDHM5O/mitre
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGWXNAEEVRUZ5JG4EJAIIFC3CI7LFETV/mitre
- www.debian.org/security/2023/dsa-5435mitre
News mentions
0No linked articles in our index yet.