b2b-daily
Home | IT | Cyber Security

Critical SQL Injection Flaw Patched in Apache Traffic Control Update

Avatar photo
by Tailor Jackson
December 26, 2024
Critical SQL Injection Flaw Patched in Apache Traffic Control Update

In a significant effort to address a critical security flaw, the Apache Software Foundation (ASF) has released a patch for a vulnerability in Apache Traffic Control, an open-source Content Delivery Network (CDN) project. This vulnerability, identified as CVE-2024-45387, has been assigned an alarming severity score of 9.9 out of 10 on the Common Vulnerability Scoring System (CVSS). The flaw allows a privileged user with roles such as ‘admin,’ ‘federation,’ ‘operations,’ ‘portal,’ or ‘steering’ to execute arbitrary SQL commands in the database through a specially crafted PUT request. The discovery was made by Yuan Luo from Tencent YunDing Security Lab, prompting a response from ASF to mitigate the risk.

In response to the identified threat, ASF promptly issued a patch included in the updated version 8.0.2 of Apache Traffic Control. The swift action was crucial to secure the framework against potential malicious exploitation. The nature of the flaw enables those with specific roles more control than intended, compromising the database’s integrity. Such a severe vulnerability underscores the importance of maintaining updated software systems and vigilant security practices within organizations relying on Apache Traffic Control for their content delivery needs. The update to version 8.0.2 is strongly advised for all users to safeguard their systems effectively.

Alongside the fix for Apache Traffic Control, ASF has recently addressed other critical security issues within its ecosystem. This includes an authentication bypass flaw in Apache HugeGraph-Server, identified as CVE-2024-43441 and resolved in version 1.5.0. Additionally, a remote code execution vulnerability found in Apache Tomcat, CVE-2024-56337, has been rectified. These updates reflect ASF’s ongoing commitment to enhancing the security and resilience of its software offerings.

Users are urged to swiftly upgrade their Apache Traffic Control installations to the latest version 8.0.2, ensure Apache HugeGraph-Server is updated to version 1.5.0, and verify their Apache Tomcat installations are current. The persistent emergence of security vulnerabilities highlights the necessity for continuous vigilance and timely software updates to protect against evolving cybersecurity threats. Proactive measures and attention to security advisories are essential in maintaining robust defenses against potential exploits.

Information Security

Explore more

Trend Analysis: Hybrid Data Center Cooling
April 28, 2026

AI-scale heat now arrives faster than facility upgrades can catch up, pushing operators to blend air and liquid in the same white space to tap stranded power, protect SLAs, and stretch budgets without gutting mechanical plants. This hybrid path preserves existing assets, trims PUE and WUE, and redirects CAPEX toward compute, not wholesale rebuilds. Why Hybrid Cooling Is Accelerating in

Are Old Cyber Threats Winning on New, Trusted Frontiers?
April 28, 2026

The Week Trust Got Complicated—Familiar Threats on Modern Rails The week’s breach tape read like a déjà vu playlist scored for modern instruments, as red teams and incident responders pointed to old-school tactics—social engineering, credential theft, backdoors—riding on the rails of “trusted” channels such as browser extensions, remote management tools, CI/CD systems, and even AI agents that browse and click

Can a Texas-First Data Center Scale From 100MW to 1GW?
April 28, 2026

Dominic Jainy is an IT professional steeped in AI, machine learning, and blockchain who studies how real infrastructure unlocks heavy compute. In this conversation, he digs into a Texas-first campus that starts at 100MW in Glasscock County and is engineered to scale toward 1GW. The themes span speed-to-power, behind-the-meter gas, ERCOT integration, and AI-ready design, all anchored in local execution

Maine Governor Vetoes Data Center Moratorium, Orders Review
April 28, 2026

Maine’s high-profile veto of a blanket data center moratorium reshaped the balance between economic revival, grid reliability, and environmental stewardship while signaling how states may govern AI-era computing growth. The decision turned a statewide pause into a targeted oversight push, reframing risk as something to be managed with standards rather than stopped outright. For investors, utilities, and communities, the move

Have You Patched Notepad++ Find in Files CVEs Yet?
April 28, 2026

Routine text searches were meant to speed up work, yet a flaw in Notepad++ turned a familiar shortcut into a subtle risk when a crafted string could crash the app or spill memory details that help attackers line up their next move. The issue centered on how the Find in Files feature rendered results, and it showed why even small