CVE-2025-31698: 
Apache Traffic Server Analyse et atténuation des vulnérabilités

Apache Traffic Server (ATS) contains a security vulnerability (CVE-2025-31698) related to Access Control List (ACL) configuration. The vulnerability affects ATS versions 9.0.0 through 9.2.10 and 10.0.0 through 10.0.6, where ACL configured in ip_allow.config or remap.config does not properly utilize IP addresses provided by the PROXY protocol (Wiz, NVD).

The vulnerability is classified as an Improper Access Control issue (CWE-284). When Apache Traffic Server is configured to accept PROXY protocol, the ACL implementation fails to properly handle IP addresses provided through this protocol. This affects the security controls implemented in both ip_allow.config and remap.config configuration files. The vulnerability has received a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD, Wiz).

The vulnerability could potentially lead to bypass of access control restrictions, as the system fails to properly enforce ACL rules based on client IP addresses provided through the PROXY protocol. This could result in unauthorized access to resources that should be restricted by the configured ACL rules (Wiz).

Apache has released patched versions 9.2.11 and 10.0.6 to address this vulnerability. Users are recommended to upgrade to these versions or later. Additionally, a new configuration setting (proxy.config.acl.subjects) has been introduced to allow administrators to specify which IP addresses should be used for ACL evaluation when PROXY protocol is in use (NVD, Debian).