CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8022
https://notcve.org/view.php?id=CVE-2018-8022
A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This affects version 6.2.2. To resolve this issue users running 6.2.2 should upgrade to 6.2.3 or later versions. Una negociación TLS inválida cuidadosamente manipulada puede provocar un segfault en Apache Traffic Server (ATS). Esto afecta a la versión 6.2.2. • http://www.securityfocus.com/bid/105183 https://github.com/apache/trafficserver/pull/2147 https://lists.apache.org/thread.html/ce404d2fe16cc59085ece5a6236ccd1549def471a2a9508198d966b1%40%3Cusers.trafficserver.apache.org%3E • CWE-20: Improper Input Validation •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2018-8005
https://notcve.org/view.php?id=CVE-2018-8005
When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache. This can cause performance problems with large objects in cache. This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x users should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. Cuando hay múltiples rangos en una petición de rango, Apache Traffic Server (ATS) leerá el objeto completo desde la caché. • http://www.securityfocus.com/bid/105187 https://github.com/apache/trafficserver/pull/3106 https://github.com/apache/trafficserver/pull/3124 https://lists.apache.org/thread.html/55d225af92887bfed0194400fd1b718622cca4140fc7318d982e25ca%40%3Cusers.trafficserver.apache.org%3E https://www.debian.org/security/2018/dsa-4282 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2018-1318
https://notcve.org/view.php?id=CVE-2018-1318
Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request. This affects versions Apache Traffic Server (ATS) 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. La adición de métodos de listas de control de acceso en remap.config puede provocar un segfault cuando el usuario realiza una petición cuidadosamente manipulada. Esto afecta a Apache Traffic Server (ATS) desde la versión 6.0.0 hasta la 6.2.2 y desde la versión 7.0.0 hasta la 7.1.3. • http://www.securityfocus.com/bid/105176 https://github.com/apache/trafficserver/pull/3195 https://lists.apache.org/thread.html/9357cdfb6352f72944411608b712e37196ad9e4bc0f17c4828a26fb2%40%3Cusers.trafficserver.apache.org%3E https://www.debian.org/security/2018/dsa-4282 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2018-8004
https://notcve.org/view.php?id=CVE-2018-8004
There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. Hay múltiples problemas de "HTTP smuggling" y envenenamiento de caché cuando los clientes que realizan peticiones maliciosas interactúan con Apache Traffic Server (ATS). Esto afecta a las versiones desde la 6.0.0 hasta la 6.2.2 y desde la versión 7.0.0 hasta la 7.1.3. • https://github.com/mosesrenegade/CVE-2018-8004 http://www.securityfocus.com/bid/105192 https://github.com/apache/trafficserver/pull/3192 https://github.com/apache/trafficserver/pull/3201 https://github.com/apache/trafficserver/pull/3231 https://github.com/apache/trafficserver/pull/3251 https://lists.apache.org/thread.html/7df882eb09029a4460768a61f88a30c9c30c9dc88e9bcc6e19ba24d5%40%3Cusers.trafficserver.apache.org%3E https://www.debian.org/security/2018/dsa-4282 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 5.3EPSS: 4%CPEs: 3EXPL: 0CVE-2018-8040
https://notcve.org/view.php?id=CVE-2018-8040
Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. Las páginas que se renderizan mediante el plugin ESI pueden tener acceso a la cabecera de la cookie cuando el plugin está configurado para no permitir el acceso. Esto afecta a Apache Traffic Server (ATS) desde la versión 6.0.0 hasta la 6.2.2 y desde la versión 7.0.0 hasta la 7.1.3. • http://www.securityfocus.com/bid/105181 https://github.com/apache/trafficserver/pull/3926 https://lists.apache.org/thread.html/36b3df68fe7311965f6bc4630ca413d2aa99d8f1d53affda85ea70d7%40%3Cusers.trafficserver.apache.org%3E https://lists.apache.org/thread.html/cc7aa2ce1c6f4fe0c6bfef517763cdaad30ec7bcb0115b73f73f3c01%40%3Cusers.trafficserver.apache.org%3E https://www.debian.org/security/2018/dsa-4282 • CWE-668: Exposure of Resource to Wrong Sphere •