oss-sec mailing list archives
[ANNOUNCE] Apache Traffic Server vulnerability with method ACLs - CVE-2018-1318
From: Bryan Call <bcall () apache org>
Date: Tue, 28 Aug 2018 15:39:48 -0700
CVE-2018-1318: Apache Traffic Server vulnerability with method ACLs Reported By: Leif Hedstrom Vendor: The Apache Software Foundation Version Affected: ATS 6.0.0 to 6.2.2 ATS 7.0.0 to 7.1.3 Description: Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. Mitigation: 6.x users should upgrade to 6.2.3 or later versions 7.x users should upgrade to 7.1.4 or later versions References: Downloads: https://trafficserver.apache.org/downloads Github Pull Request: https://github.com/apache/trafficserver/pull/3195 CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1318 -Bryan
Current thread:
- [ANNOUNCE] Apache Traffic Server vulnerability with method ACLs - CVE-2018-1318 Bryan Call (Aug 29)