oss-sec mailing list archives
[ANNOUNCE] Apache Traffic Server vulnerability with multiple HTTP smuggling and cache poisoning attacks - CVE-2018-8004
From: Bryan Call <bcall () apache org>
Date: Tue, 28 Aug 2018 15:39:49 -0700
CVE-2018-8004: Apache Traffic Server vulnerability with multiple HTTP smuggling and cache poisoning attacks Reported By: RĂ©gis Leroy Vendor: The Apache Software Foundation Version Affected: ATS 6.0.0 to 6.2.2 ATS 7.0.0 to 7.1.3 Description: There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with ATS. Mitigation: 6.x users should upgrade to 6.2.3 or later versions 7.x users should upgrade to 7.1.4 or later versions References: Downloads: https://trafficserver.apache.org/downloads Github Pull Request: https://github.com/apache/trafficserver/pull/3192 https://github.com/apache/trafficserver/pull/3201 https://github.com/apache/trafficserver/pull/3231 https://github.com/apache/trafficserver/pull/3251 CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8004 -Bryan
Current thread:
- [ANNOUNCE] Apache Traffic Server vulnerability with multiple HTTP smuggling and cache poisoning attacks - CVE-2018-8004 Bryan Call (Aug 29)