CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2018-8004
https://notcve.org/view.php?id=CVE-2018-8004
There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. Hay múltiples problemas de "HTTP smuggling" y envenenamiento de caché cuando los clientes que realizan peticiones maliciosas interactúan con Apache Traffic Server (ATS). Esto afecta a las versiones desde la 6.0.0 hasta la 6.2.2 y desde la versión 7.0.0 hasta la 7.1.3. • https://github.com/mosesrenegade/CVE-2018-8004 http://www.securityfocus.com/bid/105192 https://github.com/apache/trafficserver/pull/3192 https://github.com/apache/trafficserver/pull/3201 https://github.com/apache/trafficserver/pull/3231 https://github.com/apache/trafficserver/pull/3251 https://lists.apache.org/thread.html/7df882eb09029a4460768a61f88a30c9c30c9dc88e9bcc6e19ba24d5%40%3Cusers.trafficserver.apache.org%3E https://www.debian.org/security/2018/dsa-4282 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 5.3EPSS: 4%CPEs: 3EXPL: 0CVE-2018-8040
https://notcve.org/view.php?id=CVE-2018-8040
Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions. Las páginas que se renderizan mediante el plugin ESI pueden tener acceso a la cabecera de la cookie cuando el plugin está configurado para no permitir el acceso. Esto afecta a Apache Traffic Server (ATS) desde la versión 6.0.0 hasta la 6.2.2 y desde la versión 7.0.0 hasta la 7.1.3. • http://www.securityfocus.com/bid/105181 https://github.com/apache/trafficserver/pull/3926 https://lists.apache.org/thread.html/36b3df68fe7311965f6bc4630ca413d2aa99d8f1d53affda85ea70d7%40%3Cusers.trafficserver.apache.org%3E https://lists.apache.org/thread.html/cc7aa2ce1c6f4fe0c6bfef517763cdaad30ec7bcb0115b73f73f3c01%40%3Cusers.trafficserver.apache.org%3E https://www.debian.org/security/2018/dsa-4282 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2017-7671
https://notcve.org/view.php?id=CVE-2017-7671
There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump. Hay una vulnerabilidad de ataque de denegación de servicio en Apache Traffic Server (ATS) de las versión 5.2.0 a la 5.3.2; versión 6.0.0 a 6.2.0 y la versión 7.0.0 con la negociación TLS. Este problema puede provocar que el sistema vuelque la memoria. • https://lists.apache.org/thread.html/203bdcf9bbb718f3dc6f7aaf3e2af632474d51fa9e7bfb7832729905%40%3Cdev.trafficserver.apache.org%3E https://www.debian.org/security/2018/dsa-4128 • CWE-20: Improper Input Validation •
CVSS: 8.6EPSS: 0%CPEs: 10EXPL: 0CVE-2017-5660
https://notcve.org/view.php?id=CVE-2017-5660
There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and line folding. This can have issues when interacting with upstream proxies and the wrong host being used. Hay una vulnerabilidad en Apache Traffic Server (ATS) en versiones 6.2.0 y anteriores y versiones 7.0.0 y anteriores con la cabecera Host y el plegado de líneas. Esto puede provocar problemas al interactuar con proxies ascendentes empleando el host erróneo. • https://lists.apache.org/thread.html/22d84783d94c53a5132ec89f002fe5165c87561a9428bcb6713b3c98%40%3Cdev.trafficserver.apache.org%3E https://www.debian.org/security/2018/dsa-4128 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3624
https://notcve.org/view.php?id=CVE-2014-3624
Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT. Apache Traffic Server en versiones 5.1.x anteriores a la 5.1.1 permite que atacantes remotos omitan las restricciones de acceso aprovechando el error a la hora de crear un canal seguro para las peticiones de reasignación empleando CONNECT. • http://mail-archives.apache.org/mod_mbox/www-announce/201411.mbox/%3C20141101231749.2E3561043F%40minotaur.apache.org%3E http://www.securityfocus.com/bid/101630 https://issues.apache.org/jira/browse/TS-2677 • CWE-284: Improper Access Control •