[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAGjw+kOHgFFfinHB5+F0gf8+Azvz_k8mMEsEJm5eYhG-dHuc0A@mail.gmail.com>
Date: Wed, 2 Apr 2025 13:45:38 -0600
From: Masakazu Kitajo <maskit@...che.org>
To: announce@...fficserver.apache.org, Dev <dev@...fficserver.apache.org>,
users <users@...fficserver.apache.org>, security@...fficserver.apache.org
Cc: oss-security@...ts.openwall.com
Subject: [ANNOUNCE] ATS is vulnerable to request smuggling via chunked messages
Description:
ATS is vulnerable to request smuggling via chunked messages
CVE:
CVE-2024-53868 - Chunked message body allows request smuggling
Reported By:
Jeppe Bonde Weikop (CVE-2024-53868)
Vendor:
The Apache Software Foundation
Version Affected:
ATS 9.0.0 to 9.2.9
ATS 10.0.0 to 10.0.4
Mitigation:
9.x users should upgrade to 9.2.10 or later versions
10.x users should upgrade to 10.0.5 or later versions
CVE:
https://www.cve.org/CVERecord?id=CVE-2024-53868
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
