CVE catalog

CVE-2022-37392

trafficserver: CVE-2022-37392

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.18% · Oct 25, 2026

Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantrafficserverbookworm9.2.5+ds-0+deb12u4fixed
Debiantrafficserverbookworm-security9.2.5+ds-0+deb12u4fixed
Ubuntutrafficserver16.045.3.0-2ubuntu1vulnerable
Ubuntutrafficserver16.045.3.0-2ubuntu2vulnerable
Ubuntutrafficserver18.047.0.0-5vulnerable
Ubuntutrafficserver18.047.1.2+ds-2vulnerable
Ubuntutrafficserver18.047.1.2+ds-2build1vulnerable
Ubuntutrafficserver18.047.1.2+ds-3vulnerable
Ubuntutrafficserverpro8.1.1+ds-1.1vulnerable
Ubuntutrafficserverpro9.1.1+ds-2build1vulnerable
Ubuntutrafficserverpro9.1.1+ds-2ubuntu0.1~esm1vulnerable
Ubuntutrafficserverpro9.1.1+ds-2ubuntu0.1vulnerable
Ubuntutrafficserverpro9.1.1+ds-2ubuntu0.1+esm1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantrafficserversourcebookworm9.1.4+ds-1not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [trafficserver]Fixed
    Details (4)

    • 9.2.5+ds-0+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 9.1.4+ds-1

      dsa · trafficserver · debian · bookworm

    • 9.2.5+ds-0+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 9.1.4+ds-1

      dsa · trafficserver · debian · bookworm

    • 9.2.5+ds-0+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 9.1.4+ds-1

      dsa · trafficserver · debian · bookworm

    • 9.2.5+ds-0+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 9.1.4+ds-1

      dsa · trafficserver · debian · bookworm

  • [trafficserver-dev]Fixed

    Source package: [trafficserver]

    Details (4)

    • 9.2.5+ds-0+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 9.1.4+ds-1

      dsa · trafficserver · debian · bookworm

    • 9.2.5+ds-0+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 9.1.4+ds-1

      dsa · trafficserver · debian · bookworm

    • 9.2.5+ds-0+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 9.1.4+ds-1

      dsa · trafficserver · debian · bookworm

    • 9.2.5+ds-0+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 9.1.4+ds-1

      dsa · trafficserver · debian · bookworm

  • [trafficserver-experimental-plugins]Fixed

    Source package: [trafficserver]

    Details (4)

    • 9.2.5+ds-0+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 9.1.4+ds-1

      dsa · trafficserver · debian · bookworm

    • 9.2.5+ds-0+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 9.1.4+ds-1

      dsa · trafficserver · debian · bookworm

    • 9.2.5+ds-0+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 9.1.4+ds-1

      dsa · trafficserver · debian · bookworm

    • 9.2.5+ds-0+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 9.1.4+ds-1

      dsa · trafficserver · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]