Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 2 Nov 2021 14:25:48 -0700
From: Bryan Call <bcall@...che.org>
To: oss-security@...ts.openwall.com
Subject: Apache Traffic Server is vulnerable to various smuggle, DOS, and
 validation attacks

Description:
Apache Traffic Server is vulnerable to various smuggle, DOS, and validation attacks

CVE (8.1.x and 9.1.x):
CVE-2021-37147 Request Smuggling - LF line ending
CVE-2021-37148 Request Smuggling - transfer encoding validation
CVE-2021-37149 Request Smuggling - multiple attacks
CVE-2021-41585 ATS stops accepting connections on FreeBSD
CVE-2021-43082 heap-buffer-overflow with stats-over-http plugin

CVE (8.1.x):
CVE-2021-38161 Not validating origin TLS certificate

Reported By:
Mattias Grenfeldt and Asta Olofsson (CVE-2021-37147, CVE-2021-37148, CVE-2021-37149)
Asbjorn Bjornstad (CVE-2021-41585)
Masaori Koshiba (CVE-2021-43082)
Robert Butts (CVE-2021-38161)

Vendor:
The Apache Software Foundation

Version Affected:
ATS 8.0.0 to 8.1.2
ATS 9.0.0 to 9.1.0

Mitigation:
8.x users should upgrade to 8.1.3 or later versions
9.x users should upgrade to 9.1.1 or later versions

References:
  Downloads:
    https://trafficserver.apache.org/downloads
    (Please use backup sites from the link only if the mirrors are unavailable) 
  CVE:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37147
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37148
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37149
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41585
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43082
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38161

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.