CVE-2023-33933
Apache Traffic Server: s3_auth plugin problem with hash calculation
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.
8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.
8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
- Record
CVE-2023-33933- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List
Apache Traffic Server: s3_auth plugin problem with hash calculation
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.
8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
- Record
CVE-2023-33933- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2023-38083
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.
8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
- Record
EUVD-2023-38083- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2873-9vw6-x36q
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software...
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.
8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
- Record
GHSA-2873-9vw6-x36q- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Apache Traffic Server: s3_auth plugin problem with hash calculation
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.
8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
- Record
CVE-2023-33933- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-33933
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
- Record
DEBIAN-CVE-2023-33933- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVOESA-2023-1972
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.
(CVE-2022-47184)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.
8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
(CVE-2023-33933)
- Record
OESA-2023-1972- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2023-1973
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.
(CVE-2022-47184)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.
8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
(CVE-2023-33933)
- Record
OESA-2023-1973- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2023-1974
trafficserver security update
Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse, forward and transparent proxy and cache.
Security Fix(es):
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.
(CVE-2022-47184)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0.
8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
(CVE-2023-33933)
- Record
OESA-2023-1974- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-33933
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 9.2.0. 8.x users should upgrade to 8.1.7 or later versions 9.x users should upgrade to 9.2.1 or later versions
- Record
UBUNTU-CVE-2023-33933- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
trafficserverDebian:12 |
before 9.2.0+ds-2+deb12u1, plus listed versions 9.2.0+ds-2 |
9.2.0+ds-2+deb12u1 |
trafficserverDebian:10 From an advisory covering 3 CVEs |
before 8.1.7-0+deb10u1, plus listed versions 8.0.2+ds-18.0.2+ds-1+deb10u18.0.2+ds-1+deb10u28.0.2+ds-1+deb10u38.0.2+ds-1+deb10u4 Show 21 moreShow less8.0.2+ds-1+deb10u58.0.2+ds-1+deb10u68.0.2+ds-1+deb10u78.0.3+ds-18.0.3+ds-28.0.3+ds-38.0.3+ds-48.0.5+ds-18.0.5+ds-28.0.5+ds-38.0.6+ds-18.0.7+ds-18.0.8+ds-18.0.8+ds-28.1.0+ds-18.1.0+ds-28.1.1+ds-18.1.1+ds-1.18.1.5+ds-1~deb11u18.1.6+ds-1~deb10u18.1.6+ds-1~deb11u1 |
8.1.7-0+deb10u1 |
trafficserverDebian:11 From an advisory covering 3 CVEs |
before 8.1.7+ds-1~deb11u1, plus listed versions 8.1.1+ds-1.18.1.1+ds-1.1+deb11u18.1.5+ds-1~deb11u18.1.6+ds-1~deb10u18.1.6+ds-1~deb11u1 |
8.1.7+ds-1~deb11u1 |
trafficserverDebian:12 From an advisory covering 3 CVEs |
before 9.2.0+ds-2+deb12u1, plus listed versions 9.2.0+ds-2 |
9.2.0+ds-2+deb12u1 |
trafficserveropenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 9.1.4-2.oe1 | 9.1.4-2.oe1 |
trafficserveropenEuler:20.03-LTS-SP3 From an advisory covering 2 CVEs |
before 9.1.4-2.oe1 | 9.1.4-2.oe1 |
trafficserveropenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 9.1.4-2.oe2003sp4 | 9.1.4-2.oe2003sp4 |
trafficserverUbuntu:16.04:LTS |
All versions, plus listed versions 5.3.0-2ubuntu15.3.0-2ubuntu2 |
None known |
trafficserverUbuntu:18.04:LTS |
All versions, plus listed versions 7.0.0-57.1.2+ds-27.1.2+ds-2build17.1.2+ds-3 |
None known |
trafficserverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 8.0.5+ds-18.0.5+ds-28.0.5+ds-2build18.0.5+ds-2ubuntu18.0.5+ds-38.0.5+ds-3ubuntu0.1~esm1 |
None known |
trafficserverUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 8.1.1+ds-1.19.1.1+ds-2build19.1.1+ds-2ubuntu0.1~esm19.1.1+ds-2ubuntu0.19.1.1+ds-2ubuntu0.1+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-33933 is a high vulnerability (CVSS 7.5) in Apache Traffic Server, published June 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. Fixed in trafficserver 9.2.0+ds-2+deb12u1.
References
lists.apache.org/thread/tns2b4khyyncgs5v5p9y35pobg9z2bvs
debian.org/security/2023/dsa-5435
lists.fedoraproject.org/archives/list/[email protected]/message/6GDCBNFDDW6ULW7CACJCPENI7BVDHM5O
lists.debian.org/debian-lts-announce/2023/06/msg00037.html
nvd.nist.gov/vuln/detail/CVE-2023-33933
Show 9 moreShow less
github.com/advisories/GHSA-2873-9vw6-x36q
security-tracker.debian.org/tracker/CVE-2023-33933
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1972
ubuntu.com/security/CVE-2023-33933
cve.org/CVERecord?id=CVE-2023-33933