1668 matches found
CVE-2018-8004
CVE-2018-8004 affects Apache Traffic Server (ATS) and is due to HTTP smuggling and cache‑poisoning issues. The vulnerability impacts ATS versions 6.0.0–6.2.2 and 7.0.0–7.1.3, with fixed releases 6.2.3+ and 7.1.4+ recommended. Public sources describe multiple parsing flaws (e.g., header parsing in...
CVE-2018-1318
Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server ATS 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrad...
CVE-2018-8005
When there are multiple ranges in a range request, Apache Traffic Server ATS will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgra...
CVE-2018-8040
Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server ATS versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions...
CVE-2018-8040
Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server ATS versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions...
CVE-2018-8022
A carefully crafted invalid TLS handshake can cause Apache Traffic Server ATS to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions...
CVE-2018-8005
When there are multiple ranges in a range request, Apache Traffic Server ATS will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgra...
CVE-2018-8004
There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server ATS. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users...
Apache Traffic Server 6.x < 6.2.2 / 7.x < 7.1.2 Host Header and Line Folding Vulnerability
According to its banner, the version of Apache Traffic Server running on the remote host is 6.x prior to 6.2.2 or 7.x prior to 7.1.2. It is, therefore, affected by an input-validation vulnerability related to handling 'Host' headers and line folding that allows a remote attacker to cause the wron...
Apache Traffic Server 5.2.0 - 5.3.2 / 6.x < 6.2.2 / 7.x < 7.1.2 TLS Handshake DoS
According to its banner, the version of Apache Traffic Server running on the remote host is between 5.2.0 and 5.3.2, 6.x prior to 6.2.2 or 7.x prior to 7.1.2. It is, therefore, affected by a flaw related to handling TLS handshakes that allows a remote attacker to crash the application. Note that...
Apache Traffic Server Elevation of Privilege Vulnerability
Apache Traffic Server ATS is the United States Apache Apache Software Foundation of an efficient and scalable HTTP proxy and caching server. An elevation of privilege vulnerability exists in Apache Traffic Server. An attacker could exploit this vulnerability to gain access...
Debian DSA-4128-1 : trafficserver - security update
Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server. They could lead to the use of an incorrect upstream proxy, or allow a remote attacker to cause a denial-of-service by application crash. C Tenable Network Security, Inc. The descriptive text and...
[SECURITY] [DSA 4128-1] trafficserver security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4128-1 [email protected] https://www.debian.org/security/ Sebastien Delafond March 02, 2018 https://www.debian.org/security/faq -...
Apache Traffic Server Denial of Service Vulnerability (CNVD-2018-06433)
Apache Traffic Server or ATS or TS for short , is a high-performance , modular HTTP proxy and caching server . A denial of service vulnerability exists in the TLS handshake in Apache Traffic Server ATS 5.2.0 through 5.3.2, 6.0.0 through 6.2.0, and 7.0.0. An attacker can exploit this vulnerability...
Apache Traffic Server (ATS) Host Header and Line Folding Security Bypass Vulnerability
Apache Traffic Server is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Apache Traffic Server (ATS) TLS Handshake DOS Vulnerability
Apache Traffic Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2017-5660
There is a vulnerability in Apache Traffic Server ATS 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used...
CVE-2017-5660
There is a vulnerability in Apache Traffic Server ATS 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used...
