CVE-2022-40743

NameCVE-2022-40743
DescriptionImproper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. Users should upgrade to 9.1.4 or later versions.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
trafficserver (PTS)buster (security), buster, buster (lts)8.1.7-0+deb10u4fixed
bullseye8.1.10+ds-1~deb11u1fixed
bullseye (security)8.1.11+ds-0+deb11u1fixed
bookworm (security), bookworm9.2.5+ds-0+deb12u1fixed
sid9.2.5+ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
trafficserversourcebuster(not affected)
trafficserversourcebullseye(not affected)
trafficserversource(unstable)9.1.4+ds-1

Notes

[bullseye] - trafficserver <not-affected> (Vulnerable code not present)
[buster] - trafficserver <not-affected> (Vulnerable code not present)
https://lists.apache.org/thread/mrj2lg4s0hf027rk7gz8t7hbn9xpfg02
https://github.com/apache/trafficserver/commit/eb5efe19e68e51db58a6320b4a99e3fc83336a14 (master)
https://github.com/apache/trafficserver/commit/20c857a785da93fa0e3263597207b5ef35b65b7c (v9.1.x)

Search for package or bug name: Reporting problems