b2b-daily
Home | IT | Cyber Security

Critical SQL Injection Flaw Patched in Apache Traffic Control Update

Avatar photo
by Tailor Jackson
December 26, 2024
Critical SQL Injection Flaw Patched in Apache Traffic Control Update

In a significant effort to address a critical security flaw, the Apache Software Foundation (ASF) has released a patch for a vulnerability in Apache Traffic Control, an open-source Content Delivery Network (CDN) project. This vulnerability, identified as CVE-2024-45387, has been assigned an alarming severity score of 9.9 out of 10 on the Common Vulnerability Scoring System (CVSS). The flaw allows a privileged user with roles such as ‘admin,’ ‘federation,’ ‘operations,’ ‘portal,’ or ‘steering’ to execute arbitrary SQL commands in the database through a specially crafted PUT request. The discovery was made by Yuan Luo from Tencent YunDing Security Lab, prompting a response from ASF to mitigate the risk.

In response to the identified threat, ASF promptly issued a patch included in the updated version 8.0.2 of Apache Traffic Control. The swift action was crucial to secure the framework against potential malicious exploitation. The nature of the flaw enables those with specific roles more control than intended, compromising the database’s integrity. Such a severe vulnerability underscores the importance of maintaining updated software systems and vigilant security practices within organizations relying on Apache Traffic Control for their content delivery needs. The update to version 8.0.2 is strongly advised for all users to safeguard their systems effectively.

Alongside the fix for Apache Traffic Control, ASF has recently addressed other critical security issues within its ecosystem. This includes an authentication bypass flaw in Apache HugeGraph-Server, identified as CVE-2024-43441 and resolved in version 1.5.0. Additionally, a remote code execution vulnerability found in Apache Tomcat, CVE-2024-56337, has been rectified. These updates reflect ASF’s ongoing commitment to enhancing the security and resilience of its software offerings.

Users are urged to swiftly upgrade their Apache Traffic Control installations to the latest version 8.0.2, ensure Apache HugeGraph-Server is updated to version 1.5.0, and verify their Apache Tomcat installations are current. The persistent emergence of security vulnerabilities highlights the necessity for continuous vigilance and timely software updates to protect against evolving cybersecurity threats. Proactive measures and attention to security advisories are essential in maintaining robust defenses against potential exploits.

Information Security

Explore more

Cutefish Linux Aims to Run Native macOS Apps With Reef Framework
November 9, 2026

Current internal testing of the Reef framework has successfully demonstrated the ability to run applications such as NetNewsWire and Ghostty on a Linux desktop environment. This breakthrough represents a significant shift from the project’s origins as a cosmetic shell toward becoming a technically robust operating system. While the initial CutefishOS was praised for its visual fidelity to Apple’s ecosystem, the

Claude Code Settings File Leaks Secrets in GitHub Repositories
November 9, 2026

When Anthropic’s coding assistant saves an approved shell command to its local configuration, it records the entire string word-for-word, including any sensitive tokens or secrets typed directly into the prompt. While this feature aims to streamline the development workflow by reducing repetitive prompts, it creates a significant security vulnerability by persisting plain-text credentials in the local configuration file. Security researchers

Top Digital Marketing Agencies in Karachi for 2026
November 9, 2026

The financial and economic importance of Karachi creates a high-stakes environment where firms must secure top-tier digital partners to remain competitive. As the city functions as the commercial engine of Pakistan, the shift toward sophisticated digital ecosystems has moved beyond simple social media presence into complex data-driven strategies. Businesses operating in this megalopolis are currently navigating an era where internet

Jennifer Abruzzo Urges Sweeping Federal Labor Law Reform
November 9, 2026

Legislative goals for labor reform are shifting toward a comprehensive overhaul that addresses the specific technological and economic realities of the twenty-first century. This movement, championed by legal figures like Jennifer Abruzzo, signals a dramatic departure from previous legislative attempts that proved insufficient for the modern era. While the Protecting the Right to Organize (PRO) Act served as a foundational

What Caused the Queens Public Library Ransomware Attack?
November 9, 2026

The outage rendered essential services like automated check-out kiosks and digital media streaming platforms completely unavailable to the borough’s diverse population. This totalizing encryption event did not merely represent a temporary technical glitch but instead signaled a fundamental breach of the intellectual and social infrastructure that millions of New Yorkers rely on daily. As the digital heart of the system

Fill out the form below