CVE-2024-50306

During startup, Apache Traffic Server should drop its privileges (privilege drop) to the level of a regular user. Due to failure to verify the return value from the appropriate system function, this operation may fail without the application detecting the error. As a result, the server process continues to operate with retained elevated privileges instead of limited ones. An attacker who can influence the server's operation can consequently gain broader access to the system.

An attacker can exploit the fact that the server operates with elevated privileges to modify critical system resources (integrity violation) or disrupt its operation (availability violation). A network vector without authentication requirement increases the risk of remote exploitation.

Apache Traffic Server should be updated to version 9.2.6 (for the 9.x branch) or 10.0.2 (for the 10.x branch), which contain patches eliminating the vulnerability.

Apache Traffic Server in versions from 9.2.0 to 9.2.5 and from 10.0.0 to 10.0.1