Sebastiano Sartor

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Eclipse Grizzly السابقة للإصدار 5.0.2 **الوصف** توجد مشكلة تتمثل في عدم قدرة البرنامج على تحليل قسم «التريلر» (trailer) بشكل صحيح في سطر رأس «التريلر» الذي يحتوي على أخطاء في التنسيق. يمكن استغلال هذا الخلل لتنفيذ «تهريب طلبات HTTP» (HTTP request smuggling)، وهي تقنية تُستخدم للتدخل في الطريقة التي يعالج بها موقع الويب تسلسلات طلبات HTTP. **التوصيات** قم بالتحديث إلى الإصدار 5.0.2 أو أحدث.

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions prior to 18.12.17 **Description** The issue is related to improper control of code generation, allowing for code injection, and also involves cross-site request forgery (CSRF) and improper neutralization of special elements used in a template engine. This could potentially enable a remote attacker to perform a server-side request forgery (SSRF) attack. **Recommendations** For versions prior to 18.12.17, upgrade to version 18.12.17 to fix the issue. As a temporary workaround, consider restricting access to vulnerable components until the upgrade can be applied.