CVE catalog

CVE-2023-33933

trafficserver: CVE-2023-33933

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.50% · Oct 25, 2026

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantrafficserverbookworm9.2.5+ds-0+deb12u4fixed
Debiantrafficserverbookworm-security9.2.5+ds-0+deb12u4fixed
Ubuntutrafficserver16.045.3.0-2ubuntu1vulnerable
Ubuntutrafficserver16.045.3.0-2ubuntu2vulnerable
Ubuntutrafficserver18.047.0.0-5vulnerable
Ubuntutrafficserver18.047.1.2+ds-2vulnerable
Ubuntutrafficserver18.047.1.2+ds-2build1vulnerable
Ubuntutrafficserver18.047.1.2+ds-3vulnerable
Ubuntutrafficserverpro8.1.1+ds-1.1vulnerable
Ubuntutrafficserverpro9.1.1+ds-2build1vulnerable
Ubuntutrafficserverpro9.1.1+ds-2ubuntu0.1~esm1vulnerable
Ubuntutrafficserverpro9.1.1+ds-2ubuntu0.1vulnerable
Ubuntutrafficserverpro9.1.1+ds-2ubuntu0.1+esm1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantrafficserversourcebookworm9.2.0+ds-2+deb12u1not yet assignedNot reported[1038248]

[Debian bug #1038248]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]